1. How to read this list
A "sub-processor" is a third-party vendor that may process personal information on our behalf in the course of providing the Service. Each entry below names the vendor, category of processing, primary hosting region, and data category currently disclosed for review.
1.1Vendor processing terms, transfer terms, onward-transfer restrictions, and equivalent security obligations must be confirmed from the maintained contract/legal source.
1.2Vendors are grouped by category. The categories are hosting & infrastructure, authentication, email & alerting, AI model providers, payments, analytics & observability, maps, places, transit & travel data, travel supply, and resources loaded in your browser. We do not use ad-tech or marketing-attribution sub-processors; see the Cookie Policy for why.
1.3Where a vendor operates globally, the "Location" column shows the region intended for Airheart data. Edge transit, storage region, and transfer terms should be confirmed from the active vendor configuration and contract record.
2. Sub-processor table
Materially rewritten 2026-08-08, pending counsel review.
| Sub-processor | Purpose | Location | Data category | Transfer mechanism |
|---|---|---|---|---|
| Hosting & infrastructure | ||||
| Render | Application hosting, Postgres databases, Redis. | Vendor-operated | Account data, trip content, agent conversation history, purchase records, telemetry. | See §3 |
| Cloudflare | CDN, DNS, bot management, and cookieless aggregate web analytics; separately, media storage and delivery (Images / Stream) and the video embed SDK. | Vendor-operated | Request metadata (IP, user agent, URL); uploaded media. | See §3 |
| Temporal Cloud | Durable workflow execution. | Vendor-operated | Trip, agent, and commerce workflow payloads. | See §3 |
| Authentication | ||||
| Google Firebase | Consumer authentication. | Vendor-operated | Email, name, authentication identifiers. | See §3 |
| WorkOS | SSO / directory for organizations; admin console authentication. | Vendor-operated | Organization identity data. | See §3 |
| Email & alerting | ||||
| Brevo | Transactional and marketing email delivery. | Vendor-operated | Email address, name, message content. | See §3 |
| Slack | Operational alerting to Airheart's internal channels. Alerts include purchase-related personal data: purchaser and seller names and email addresses. | Vendor-operated | Names and emails tied to purchases, applications, and reviews. | See §3 |
| Twilio | SMS. Not currently active — Airheart does not send SMS today; the integration is retained for a future launch and disclosed ahead of it. | Vendor-operated | None today; phone numbers when the channel launches. | See §3 |
| AI model providers | ||||
| OpenAI | Model inference, embeddings, and content moderation for the planning agent. | Vendor-operated | Planning conversation content and trip context you submit to the agent. | See §3 |
| Anthropic | Model inference for the planning agent. | Vendor-operated | Planning conversation content and trip context you submit to the agent. | See §3 |
| Moonshot (Kimi) | Model inference. Not currently active. | Vendor-operated | None today. | See §3 |
| OpenRouter | Model gateway. Not currently active. A gateway resolves requests to upstream model providers it selects under its own terms — if activated, prompts routed through it reach those upstream providers, and this row is updated to say which. | Vendor-operated | None today. | See §3 |
| Payments | ||||
| Stripe | Payment processing, Connect payouts to publishers, tax calculation, and fraud prevention. | Vendor-operated | Payment method details (held by Stripe, not Airheart), purchase and payout records, billing identity. | See §3 |
| Analytics & observability — analytics rows are consent-gated on both browser and server paths | ||||
| RudderStack | Product analytics (browser and server). Events flow only with your analytics consent. | Vendor-operated | Product usage events, user identifiers — with consent only. | See §3 |
| Google Analytics | Web analytics. Loads only after analytics consent. | Vendor-operated | Page views, usage events — with consent only. | See §3 |
| Amplitude | Product analytics. Loads only after analytics consent. | Vendor-operated | Product usage events — with consent only. | See §3 |
| LogRocket | Session recording. Loads only after analytics consent. | Vendor-operated | In-app interaction recordings — with consent only. | See §3 |
| Sentry | Error tracking (browser, frontend server, and backend). | Vendor-operated | Error context and request metadata around failures. | See §3 |
| Uptrace | Distributed tracing and metrics. | Vendor-operated | Request telemetry and trace metadata. | See §3 |
| Maps, places, transit & travel data | ||||
| Google Maps Platform | Geocoding and transit on the backend; interactive maps with the Places library in the browser; two server-side static-map proxies. | Vendor-operated | Place queries, map coordinates, request metadata. | See §3 |
| Geoapify | Geocoding and places. | Vendor-operated | Place queries. | See §3 |
| HERE | Geocoding and routing. | Vendor-operated | Place and routing queries. | See §3 |
| Foursquare | Places data. | Vendor-operated | Place queries. | See §3 |
| TripAdvisor | Places and reviews data. | Vendor-operated | Place queries. | See §3 |
| TransitLand | Transit data. | Vendor-operated | Transit queries. | See §3 |
| GeoSure | Location safety scores. | Vendor-operated | Location queries. | See §3 |
| OpenMeteo | Weather data. | Vendor-operated | Location queries (no credential; public API). | See §3 |
| Motis | Transit routing. Not currently active (no deployed instance). | Vendor-operated | None today. | See §3 |
| FX provider | Currency conversion rates. | Vendor-operated | No personal data; rate lookups only. | See §3 |
| Travel supply — disclosed ahead of the booking launch; none currently active | ||||
| Duffel | Flight search and booking supply. Not currently active. | Vendor-operated | None today; traveler records when booking launches. | See §3 |
| Amadeus | Flight supply. Not currently active. | Vendor-operated | None today. | See §3 |
| Viator | Activity supply. Not currently active. | Vendor-operated | None today. | See §3 |
| Makcorps | Hotel pricing. Not currently active. | Vendor-operated | None today. | See §3 |
| Sherpa | Entry requirements. Not currently active. | Vendor-operated | None today. | See §3 |
| Parallel | Activity research. Not currently active. | Vendor-operated | None today. | See §3 |
| Loaded in your browser on page view | ||||
| Google Fonts | Font stylesheets and files, loaded on page load. | Vendor-operated | Request metadata (IP, user agent) reaches Google on every page load. | See §3 |
| Unsplash / Wikimedia Commons | Some marketing pages display images hosted by these services; loading them sends request metadata to the host. | Vendor-operated | Request metadata on the pages that use them. | See §3 |
2.1This is the current route disclosure. If a vendor appears to process Airheart customer data and is not named here, report the gap to privacy@airheart.com for legal/source review.
2.2Some vendors above themselves use sub-processors (for example, AWS's own infrastructure suppliers). Those are governed by the vendor's own terms and disclosed through their sub-processor lists; review status belongs in the legal/procurement record.
3. Transfer mechanisms
Where a sub-processor stores or processes personal information outside the European Economic Area, the United Kingdom, or Switzerland, transfer terms must be confirmed from the maintained legal source or signed contract.
- Transfer clauses — confirmed through the active contract source.
- Regional commitments — confirmed from vendor configuration and contract records.
- Technical measures — confirmed from maintained security evidence before publication.
3.1Transfer review artifacts can be requested through dpo@airheart.com and are provided where the active legal source supports them.
3.2Security measures such as encryption, tenant scoping, and minimization require maintained security evidence before this page states them as commitments.
4. Changes & notifications
Notice terms come from policy or contract.
When we plan to add or replace a sub-processor, notice timing and recipient scope are controlled by the applicable policy or signed contract. Notices should name the vendor, purpose, location, data category, and planned effective date where required.
Objection rights, alternatives, exclusions, termination rights, and refunds are contract terms, not route-local promises.
4.1Emergency replacement. If a sub-processor suffers an outage, security incident, or contract termination, emergency replacement and notice timing follow the maintained legal/ops process and any signed contract terms.
4.2Non-material changes. A vendor renaming itself, a change of business entity in the same corporate group, or a change of sub-region within the same legal jurisdiction does not trigger advance notice — but the table above is updated.
5. Contact
Questions about a specific sub-processor, processing terms, or a subscription to the notice list all go to the same inbox. Response timing is handled by the current legal operations process.
Privacy contact
Airheart Privacy, Airheart Inc.
Sub-processor questions, transfer-review requests, notice-list subscriptions, and processing-term redlines.
dpo@airheart.com privacy@airheart.com legal@airheart.comPostal address
Airheart Inc.
Attn: Privacy
1401 Lavaca Street, Unit #284
Austin, TX 78701
United States
See also: Privacy Policy and Cookie Policy.