Subîmputerniciți
v2026-08-22
Running Spinrun means other companies touch your data. This page names all of them. It is the list the Privacy Policy summarises and the list the Data Processing Agreement incorporates by reference, so it is the one to check.
Each is bound by a data-processing agreement no weaker than the one we give you, and each is engaged only for what is listed against its name.
01Infrastructure
These run the Service itself. Data reaches them whenever you use Spinrun at all.
SupabaseThe database, authentication, the job queue and vector search. Account data, workspace membership, connection records, activity logs and Brain embeddings all live here.VercelApplication hosting and delivery. Every request to the site and the gateway passes through it.Cloudflare R2Object storage for agent-authored artifacts and for tool results too large to return inline. The bucket is private and no pre-signed URL is ever issued.02Models and execution
These receive content, rather than only carrying it. If what your agents handle is sensitive, this is the section to read twice.
Vercel AI GatewayRoutes every model call. We hold no model-provider keys of our own, so this is the single path inference takes.GoogleThe Gemini models behind the playground and behind Brain embeddings, reached through the gateway above. Separately, Google sign-in, if you use it.Vercel SandboxRuns agent-authored code, on plans where sandboxes are enabled. Code and the data it is given execute in Vercel's cloud.03Connections and communication
ComposioThe toolkit catalogue and the connection infrastructure behind many integrations. It holds the authorisation for a connected application and executes the calls your agents make through it.ResendTransactional email — workspace invitations and administrative notices. It sees the recipient's address and the message.04Analytics
One provider, used for two things that are worth keeping apart.
PostHog (EU)On the marketing site: pages opened, clicks, and masked session replays — only for visitors who accepted the cookie banner, and nothing at all for those who did not. Inside the product: a short list of server-side milestone events — currently a workspace being created and a connection being added — against an account identifier, with no message content, tool arguments or customer data. Hosted on PostHog's European instance, so none of it leaves the EEA.05The applications you connect
The third-party applications you authorise — a CRM, a mailbox, a spreadsheet — are not our subprocessors. You have your own relationship with each of them under their own terms, and we exchange data with them because you told us to. What they do with it is governed by their agreement with you, not ours.
06How the list changes
We give 14 days' notice, by email to workspace owners, before a new subprocessor begins processing your data. If you object on reasonable data-protection grounds and we cannot resolve it, you may terminate the affected part of the Service.
We remain responsible for what a subprocessor does with your data as if we had done it ourselves.
07Change log
2026-08-22First published. Adds Google, the Vercel AI Gateway and Vercel Sandbox, which the Privacy Policy had not previously named.2026-08-22Adds PostHog (EU) for marketing-site analytics and server-side product events. Marketing analytics is consent-gated and is not customer data; the product events are, which is why PostHog is listed here rather than only in the Cookie Policy.PlannedRailway, to host the background worker that ingests Brain documents. Not yet in use; it will be announced here and by email before it processes anything.08Contact
Questions about this list, or a request for the transfer safeguards behind a particular provider, go to legal@spinrun.ai.