Subprocessors
Every third party that processes data on Selyf's behalf, what they see, and where.
This list is verified against the code that actually calls each service, not a planned or aspirational list — see Privacy for what each one is allowed to do with your data.
Data processors
Services that receive some part of your actual data (Gmail content, or analytics events) in order to provide the product.
| Provider | Purpose | Data type | Location |
|---|---|---|---|
| Google (Gmail API, OAuth) | Source of your Gmail data; sign-in identity | Message metadata and content for threads you open; your Google account email | Global (Google infrastructure) |
| Anthropic | AI analysis and draft generation | A thread's message content, only when you explicitly analyze or draft a reply | United States |
| Google Gemini | AI analysis and draft generation (alternate/default provider) | A thread's message content, only when you explicitly analyze or draft a reply | Global (Google infrastructure) |
| PostHog (EU Cloud) | Product usage analytics, server-side only | Event names and non-identifying properties — never Gmail content, never sent from your browser | European Union |
| Sentry (EU) | Error tracking, server-side only, unhandled server errors only | A stack trace and your account ID (not your email) — never Gmail content, subject lines, sender addresses, or tokens; filtered out before anything leaves the server | European Union |
Infrastructure
Services that run or route the product but don't process your Gmail data themselves.
| Provider | Purpose | Data type | Location |
|---|---|---|---|
| Vercel | Hosts the web app (selyf.com) — marketing pages and dashboard UI | Standard web hosting traffic; no Gmail content is processed by Vercel itself | Global (edge network), United States-headquartered |
| Cloudflare | DNS resolution for selyf.com only | DNS queries only — traffic is not proxied through Cloudflare (DNS-only / "grey-clouded"), so Cloudflare never sees request or response content | Global |
Only the web app (selyf.com) runs on Vercel. The API (api.selyf.com) and the status page (status.selyf.com) run on a separate, self-managed server — Vercel never sees Gmail content, AI requests, or database traffic, since it only ever serves the frontend. Cloudflare is DNS-only for this domain: traffic is not proxied through Cloudflare's network, so it is not in a position to process, inspect, or log any request or response content — it is not a data processor in the traffic path, only the DNS registrar/host.