Service Providers

• Supabase — database, authentication, file storage, realtime collaboration, and transactional authentication email. The production requirement is an Oceania (Sydney) primary project; Supabase and its subprocessors may also process account, security, and support data in Singapore, the United States, and other published locations. Privacy information.
• Netlify — website hosting, server runtime, deployment, content delivery, and operational logs on global infrastructure, including processing in the United States. Privacy information.
• Cloudflare — AI gateway, network delivery, short-lived Worker logs, and voice transcription through Workers AI on Cloudflare's global network. Cloudflare states that Workers AI customer content is not used to train models. Privacy information.
• Stripe — checkout, payment processing, subscription administration, tax calculation, receipts, fraud prevention, and legally required transaction records on global infrastructure. Stripe acts as a processor for some activities and an independent controller for regulated payment activities. Privacy information.
• Resend — delivery of contact-form acknowledgements, bug-report notifications, and account-related product emails. It receives recipient and reply-to addresses, the subject, and the message content. Bug attachments remain in private Supabase storage and are shared with the admin through an expiring signed link. Privacy information.
• Loops — newsletter audience and subscription management. It receives email address, name, Supabase user ID, signup source, subscription consent, and Free/Pro user group. It is not used for transactional email. Privacy information.

These providers receive data only when enabled and needed for the relevant feature:

• Inception AI — autocorrect, autocomplete, rewrite, and other text inference in the United States. Glidey's production account must disable “Improve the model for everyone”; otherwise Inception's standard terms permit model training. Privacy information.
• OpenRouter — optional routing to selected AI model endpoints in the United States and provider locations. Glidey requests enforce zero-data-retention routing and production account logging/training must remain off. Privacy information.
• Firecrawl — user-invoked web search and page retrieval in the United States. Glidey disables page-body caching. Unless Enterprise zero-data-retention mode is enabled for the deployment, Firecrawl may retain search data under its standard policies. Privacy information.
• Sentry — optional error diagnostics with request bodies and default personal information removed. The production requirement is the Germany storage region and a 30-day event-retention setting. Privacy information.
• Google Analytics — optional analytics only on the signed-out public site and a verified payment-success page, never the private workspace, and only after consent. The production requirement is 2-month event retention, reset-on-activity off, advertising features and Google signals off, and no Google Ads linking. Privacy information.
• Microsoft Clarity — optional session analytics only on the signed-out public site and a verified payment-success page, never the private workspace, and only after consent. Privacy information.
• Google Identity — optional Google sign-in, if selected by the user and enabled by Glidey, with authentication completed through Supabase. Privacy information.
• Google Gemini API — paid semantic-search embeddings for note chunks and search queries on Google's global infrastructure. Glidey requires a billing-enabled project and the Paid Services data terms before production use. Google states submitted prompts and responses on Paid Services are not used to improve its products, although limited abuse-monitoring retention may apply. Service terms.

Provider data-processing terms must be incorporated into Glidey's account agreement. Where relevant, those terms include the European Commission's Standard Contractual Clauses, the UK transfer addendum, or another lawful mechanism. Glidey also reviews location, access, deletion, retention, security, and onward-provider commitments as reasonable steps under Australian APP 8.

A provider configuration described as a “production requirement” is a condition of enabling that provider, not permission to run with a weaker setting. Material new providers will be added before they begin processing user information.