Last updated

Subprocessors

v2026-08-22

Running Spinrun means other companies touch your data. This page names all of them. It is the list the Privacy Policy summarises and the list the Data Processing Agreement incorporates by reference, so it is the one to check.

Each is bound by a data-processing agreement no weaker than the one we give you, and each is engaged only for what is listed against its name.

  1. 01Infrastructure

    These run the Service itself. Data reaches them whenever you use Spinrun at all.

    Supabase
    The database, authentication, the job queue and vector search. Account data, workspace membership, connection records, activity logs and Brain embeddings all live here.
    Vercel
    Application hosting and delivery. Every request to the site and the gateway passes through it.
    Cloudflare R2
    Object storage for agent-authored artifacts and for tool results too large to return inline. The bucket is private and no pre-signed URL is ever issued.

  2. 02Models and execution

    These receive content, rather than only carrying it. If what your agents handle is sensitive, this is the section to read twice.

    Vercel AI Gateway
    Routes every model call. We hold no model-provider keys of our own, so this is the single path inference takes.
    Google
    The Gemini models behind the playground and behind Brain embeddings, reached through the gateway above. Separately, Google sign-in, if you use it.
    Vercel Sandbox
    Runs agent-authored code, on plans where sandboxes are enabled. Code and the data it is given execute in Vercel's cloud.

  3. 03Connections and communication

    Composio
    The toolkit catalogue and the connection infrastructure behind many integrations. It holds the authorisation for a connected application and executes the calls your agents make through it.
    Resend
    Transactional email — workspace invitations and administrative notices. It sees the recipient's address and the message.

  4. 04Analytics

    One provider, used for two things that are worth keeping apart.

    PostHog (EU)
    On the marketing site: pages opened, clicks, and masked session replays — only for visitors who accepted the cookie banner, and nothing at all for those who did not. Inside the product: a short list of server-side milestone events — currently a workspace being created and a connection being added — against an account identifier, with no message content, tool arguments or customer data. Hosted on PostHog's European instance, so none of it leaves the EEA.
    Cookie Policy

  5. 05The applications you connect

    The third-party applications you authorise — a CRM, a mailbox, a spreadsheet — are not our subprocessors. You have your own relationship with each of them under their own terms, and we exchange data with them because you told us to. What they do with it is governed by their agreement with you, not ours.

  6. 06How the list changes

    We give 14 days' notice, by email to workspace owners, before a new subprocessor begins processing your data. If you object on reasonable data-protection grounds and we cannot resolve it, you may terminate the affected part of the Service.

    We remain responsible for what a subprocessor does with your data as if we had done it ourselves.

    Data Processing AgreementPrivacy Policy

  7. 07Change log

    2026-08-22
    First published. Adds Google, the Vercel AI Gateway and Vercel Sandbox, which the Privacy Policy had not previously named.
    2026-08-22
    Adds PostHog (EU) for marketing-site analytics and server-side product events. Marketing analytics is consent-gated and is not customer data; the product events are, which is why PostHog is listed here rather than only in the Cookie Policy.
    Planned
    Railway, to host the background worker that ingests Brain documents. Not yet in use; it will be announced here and by email before it processes anything.

  8. 08Contact

    Questions about this list, or a request for the transfer safeguards behind a particular provider, go to legal@spinrun.ai.

Before anything loads

We would like to switch on analytics, so we can see which pages are worth keeping. Nothing has loaded yet and nothing will until you choose. The cookies that keep you signed in and remember your language are not part of this.

Read the Cookie Policy