Subprocessors

Yekar.AI ("Yekar.AI", "we", "us") uses the third-party services below to run the platform at app.yekar.ai, its API and its consoles. Each one receives only what it needs to do the job named next to it. This page supplements our Privacy Policy, which explains how we handle personal information more generally.

Where a location is not stated, the service processes data in the regions its own documentation describes; see the provider. Each provider handles the data under its own terms and data-processing commitments.

• Cloudflare - hosts the product app, the admin and partner consoles, this website and the documentation; provides object storage (R2) for uploaded files, attachments, generated media and data exports. Data: stored files and the web traffic to those sites. Location: Cloudflare's global network; object storage region set to automatic.
• Amazon Web Services - runs the API, the background workers, the isolated browser service and the primary database (Amazon ECS and Amazon RDS); receives email sent to an email trigger's address (Amazon SES and SNS); and stores tamper-evident seals of our audit trail (Amazon S3). Data: all workspace content and account information; the inbound email message for email triggers; the seals hold hashes only, never audit contents. Location: Asia Pacific (Mumbai) for the API, workers and database; see provider for the email and audit-seal services.

How a model call is handled depends on the setting your organization chooses for each provider under Settings → AI settings → AI providers. On Own key, the call runs on your organization's own account with that provider, under your own agreement; that provider is your vendor, not our subprocessor. On Managed, the call runs on Yekar.AI's account with that provider, and the provider acts as our subprocessor. A provider that is Off receives nothing.

A model call carries the agent's instructions, the conversation, relevant knowledge and memory, tool definitions and tool results. Stored connection credentials are never included. What each provider keeps is set out in our documentation under what the model provider keeps.

• OpenAI - creates the search embeddings for knowledge and saved memory on Yekar.AI's account for every organization, and serves model calls on Managed. Data: knowledge excerpts, saved memories and search queries for embeddings; model-call content on Managed. Location: see provider.
• Anthropic - by default, structures an agent's written procedure into steps on Yekar.AI's account, whatever key setting the organization uses; serves model calls on Managed. Data: the procedure text; model-call content on Managed. Location: see provider.
• Other model providers on Managed - Google (Gemini), Amazon Bedrock, OpenRouter, Groq, xAI, Mistral, Sarvam AI, DeepSeek, Moonshot, Together AI, Fireworks AI, DeepInfra, Alibaba (Qwen), Cerebras, Cohere, SambaNova, Novita AI, NVIDIA NIM, Vercel AI Gateway, Z.ai, MiniMax, Upstage and TypeSafe AI. Each receives model-call content only when your organization sets that provider to Managed and Yekar.AI offers a managed key for it. Location: see provider.

• Serper - answers every web search run in a workspace; web search is on by default in every workspace where we offer it. Data: the search text, sent on Yekar.AI's account without your organization's identity. Location: see provider.
• Jina AI - reads public pages and answers searches for agents that use the Jina AI tool. Data: the page address or search text. Location: see provider.
• fal.ai - generates images, video and audio for organizations with media generation turned on. Data: the generation prompt. Location: see provider.

• Resend - sends operational email: activation, password reset, sign-in codes, approval requests and account notices. Data: the recipient's address and the message. Location: see provider.
• Google - signs people in with Google to the product and to Yekar.AI's own consoles. Data: name, email address and profile picture returned by Google. Location: see provider.
• Razorpay - takes plan payments for organizations billed in India. Data: plan, amount, tax breakdown and the organization's billing reference; card or UPI details are entered on Razorpay's own checkout and never reach Yekar.AI. Location: see provider.
• PayPal - takes monthly plan payments for organizations billed outside India. Data: plan, amount and the subscription reference; payment details are entered with PayPal and never reach Yekar.AI. Location: see provider.

• Sentry - receives error reports from our web apps when error reporting is enabled. Data: the error and where it happened; email addresses, tokens and query strings are removed first, and a person is represented by an opaque id. Location: see provider.
• PostHog - product analytics in the app, only for people who choose to share it, and session recording only where an administrator of the organization turns it on. Data: pages visited, identified by account and workspace, with query strings removed and no IP address in the events we send; recordings mask all text and inputs. It also receives error reports from our servers when error reporting is enabled. Data: the error and where it happened; credentials, email addresses and query strings are removed first, and no request content is included. Location: United States.

These services are used on yekar.ai and docs.yekar.ai and receive no workspace content.

• Google Analytics - website traffic, only if you accept it when each site asks. See our Cookie Policy.
• Cloudflare Web Analytics - cookieless page-view counts that do not identify you.
• Cal.com - demo scheduling, when you choose to book one on Cal.com's own page.

• Services your organization connects, such as Google Workspace, Microsoft 365, Slack or Stripe. An agent reaches them on your organization's own connection and instructions; they are your vendors.
• Model providers on Own key, which run under your organization's own agreement.
• Your own infrastructure. An Enterprise organization that runs its data plane on its own database and storage holds its workspace content there, in the region it chooses.

We update this page before adding a subprocessor that processes customer content, and change the date at the top when we do. Removing a subprocessor, or changing what an existing one is used for without widening the data it receives, is recorded here when it happens. If your organization has a signed data processing agreement with Yekar.AI, any additional notice it provides for subprocessor changes also applies.

Questions about this list can be sent through our contact page.