Sub-Processors
Last updated: August 10, 2026
Effective date: July 13, 2026
Claimory uses a small set of trusted third-party service providers ("sub-processors") to operate the Service. Each sub-processor is engaged under a contract requiring it to protect your data and to process it only for the purposes we authorize. This page is the public version of the list disclosed in Section 6.1 of our Privacy Policy. We keep both in sync.
Claimory does not sell, rent, lease, or trade your personal information to third parties for their own commercial or marketing purposes.
Where Claimory uses AI, it runs across more than one provider (see the AI entries below), so the platform is not dependent on any single AI vendor.
Current Sub-Processors
| Vendor | Purpose | Data categories | Region | DPA status |
|---|---|---|---|---|
| Supabase, Inc. | Database hosting, authentication, file and document storage, real-time sync, backend infrastructure | Account data, claim and job data, customer contact details, uploaded documents and media, usage logs | United States | Available on request |
| Stripe, Inc. | Payment processing, subscription billing, and in-portal customer payments via Stripe Connect (where a shop enables it; the shop is the merchant of record) | Billing details, payment-method metadata, transaction history, and (for in-portal payments) the paying customer's name and email (full card numbers handled by Stripe, not stored by us) | United States | Available on request |
| RevenueCat, Inc. | In-app subscription management and receipt validation for the iOS app (the Starter plan purchased through an Apple in-app purchase) | A pseudonymous app user identifier (your Claimory user id), workspace identifier, and Apple purchase, transaction, and subscription-status metadata (no card numbers; Apple handles the payment) | United States | Available on request |
| Vercel, Inc. | Hosts and delivers the Claimory website and app to your browser, including our content network and edge functions | The standard connection details every website receives when it loads a page, such as browser type and IP address, used to serve pages and help block abuse | United States | Available on request |
| Telnyx LLC | Powers the text messages a shop sends and receives through Claimory, such as appointment and status updates | The phone numbers and the wording of messages sent and received | United States | Available on request |
| Twilio Inc. | A backup text-message provider used on some message paths alongside Telnyx | The phone numbers and the wording of messages sent and received, where this path is active | United States | Available on request |
| Microsoft Corporation | Powers the optional email integration, and only when a shop chooses to connect its own Microsoft 365 or Outlook mailbox to send and receive claim email inside Claimory | Messages, attachments, and mailbox details for the account a shop connects, plus the secure tokens that authorize the connection, used only to send and sync that shop's claim email | United States | Available on request |
| Google LLC (Gmail / Google Workspace) | Powers the optional email integration, and only when a shop chooses to connect its own Google mailbox to send and receive claim email inside Claimory | Messages, attachments, and mailbox details for the account a shop connects, plus the secure tokens that authorize the connection, used only to send and sync that shop's claim email | United States | Available on request |
| Anthropic, PBC | Primary AI provider (Claude model family) for AI features; operates under zero-training terms for API customers | Claim and contextual data scoped to each AI request | United States | Available on request |
| Google LLC (Google AI Studio) | Secondary AI provider used in limited cases (embeddings, document parsing, fallback when the primary provider is unavailable) | Prompt and document content scoped to the active request | United States | Available on request |
| OpenRouter, Inc. | AI routing proxy for document text extraction and SMS rewrites in front of Anthropic and Google models | Prompt content and document or SMS text scoped to the active request | United States | Available on request |
| Google LLC (Analytics) | Web analytics (Google Analytics) to understand aggregate usage; loaded only after you accept analytics cookies | Browsing metadata collected through analytics scripts | United States, European Union | Available on request |
| Resend | Transactional email delivery for messages we send on our own behalf (welcome emails, password resets, billing notices, security alerts) | Recipient email address and message content for each email | United States | Available on request |
| Cloudflare, Inc. | Bot and abuse detection on public forms (trial signup, contact, demo request) using Cloudflare Turnstile | Minimal browser and network metadata used to score automated traffic | United States, global edge network | Available on request |
| Sentry | Application error and performance monitoring | Stack traces and contextual metadata about exceptions (common PII fields redacted where technically feasible) | United States | Available on request |
| Tavily | Web search sub-processor used for AI background research (for example, state regulations or repair-procedure references) | Search query scoped to the active request | United States | Available on request |
| ip-api.com | Estimates a website visitor's approximate location for our own site analytics | A shortened, anonymized version of your network address (not your full IP address), used only to estimate approximate location (country, region, and city). This lookup travels over standard HTTP; see Privacy Policy Section 10. | European Union | Available on request |
| Google LLC (Google Ads) | Measures whether Claimory's own ads led to a signup; loaded only after you accept marketing cookies | Ad-click and conversion identifiers, plus a scrambled version of your email that cannot be read back, used only to match a signup to an ad | United States, European Union | Available on request |
| Photon (Komoot GmbH) | Address autocomplete / geocoding | Address text you type into the address field, scoped to the active lookup | Germany (EU) | Available on request |
| Nominatim (OpenStreetMap Foundation) | Address autocomplete / geocoding fallback | Address text you type into the address field, scoped to the active lookup | EU | Available on request |
| NHTSA (U.S. Department of Transportation) | Vehicle identification number (VIN) decoding through the public NHTSA vPIC database to auto-fill a vehicle's year, make, and model | The VIN submitted for decoding (no personal contact details are sent) | United States | Available on request |
Data Processing Agreement
A Data Processing Agreement with Standard Contractual Clauses is available to customers on request. If you require a DPA for your procurement, security, or compliance review, contact info@claimory.io and we will provide the current version.
Changes to This List
We may add, remove, or replace sub-processors as the Service evolves. When we do, we update this page and Section 6.1 of the Privacy Policy together. Customers who require advance notice of sub-processor changes should request it as part of their DPA.