Subprocessors

Last updated: June 5, 2026

This page lists third-party service providers (“subprocessors”) that Senka Solutions LLC uses to operate shin.chat and that may process personal data on our behalf.

For how we collect and use personal data generally, see our Privacy Policy. For cookies and local storage, see our Cookie Policy.

We require subprocessors to process personal data only according to our instructions and appropriate contractual safeguards (including data processing terms where applicable).

Table of Contents

  1. How to Read This List
  2. Current Subprocessors
  3. AI Provider Training Policy
  4. Changes to This List
  5. Contact

1. How to Read This List

Each entry includes:

  • Legal entity — the company providing the service;
  • Purpose — why we use them;
  • Data categories — types of personal data they may receive;
  • Region — primary processing location (may include global CDN edge nodes).

This list reflects the Service as implemented in our codebase today. It does not include providers we have documented as future plans but not yet integrated (for example, payment processors).

2. Current Subprocessors

Supabase, Inc.

  • Purpose: Database (PostgreSQL), user authentication, private file storage, realtime updates, and row-level security enforcement.
  • Data categories:
    • Account identifiers (email, user UUID, session tokens);
    • All user-generated content stored in the Service (messages, conversations, notes, documents, embeddings, decisions, entities, usage events);
    • Uploaded document files in private storage buckets;
    • Authentication emails (magic links) sent via Supabase Auth’s email delivery infrastructure.
  • Region: United States (project region configured in our Supabase project; confirm your production region in the Supabase dashboard).
  • Notes: Supabase Auth email delivery may use Supabase’s default mail infrastructure or a custom SMTP provider configured in the Supabase dashboard. That SMTP provider, if configured, acts as a further sub-subprocessor for login emails only.

Anthropic PBC

  • Purpose: AI chat completions — the primary conversational model for live chat.
  • Data categories:
    • Conversation history (user and assistant messages);
    • System instructions;
    • Retrieval tool results from your workspace (summaries, decisions, notes, document excerpts) when the search tool is invoked during chat;
    • Token usage metadata returned to us (not stored by Anthropic in our usage ledger).
  • Region: United States.
  • Notes: Used via Anthropic’s commercial API. Customer content is not used to train Anthropic’s models by default under commercial API terms.

Google LLC (Gemini API)

  • Purpose: Background AI text generation — conversation titles, summaries, decision extraction, and entity extraction from conversations and notes.
  • Data categories:
    • Conversation transcripts or excerpts;
    • Note titles, bodies, and highlight quotes;
    • Structured output schemas for extraction tasks;
    • Token usage metadata.
  • Region: United States and global Google Cloud infrastructure (per Google’s API routing).
  • Notes: Used via Google’s generative AI API (gemini-3-flash-preview and successors). API customer data is not used to train Google’s models by default under applicable API terms.

OpenAI, LLC

  • Purpose: Text embeddings only — semantic search, conversation/decision/entity/note/document vector indexing.
  • Data categories:
    • Text snippets submitted for embedding (search queries, summaries, user messages, decision strings, entity labels, note text, document chunks);
    • Token usage metadata.
    • Not used for: chat completions in shin.chat.
  • Region: United States.
  • Notes: Model: text-embedding-3-large. OpenAI API customer data is not used to train OpenAI’s models by default unless separate opt-in programs apply (we have not enrolled).

Trigger.dev, Inc.

  • Purpose: Background job orchestration and execution for deferred processing (titles, summaries, embeddings, decision extraction, document ingestion, entity extraction).
  • Data categories:
    • Task payloads containing resource identifiers (conversation ID, note ID, document ID);
    • Job execution logs, error messages, and timing metadata.
    • Workers use privileged credentials to read full user content from Supabase and forward text to AI providers listed above. Trigger.dev itself does not permanently store your message content as part of normal operation beyond transient job execution.
  • Region: United States (Trigger.dev Cloud).
  • Notes: Project reference: proj_zvmknozwnqqixjdeflcq (internal identifier).

Functional Software, Inc. (Sentry)

  • Purpose: Error monitoring, performance tracing, and session replay for debugging and reliability.
  • Data categories:
    • Error stack traces and exception messages;
    • Request context (URL, HTTP method, status);
    • Device and browser metadata;
    • IP address and user agent;
    • Potentially identifying information when included in error context (for example, email addresses in email-send error extras);
    • Session replay recordings (sampled — approximately 10% of sessions, 100% of sessions where an error occurs), which may capture on-screen UI interactions.
  • Region: United States (Sentry US ingest: ingest.us.sentry.io).
  • Notes: Configured with sendDefaultPii: true. See our Cookie Policy for replay implications.

Resend, Inc.

  • Purpose: Transactional product email and early-access waitlist audience management.
  • Data categories:
    • Recipient email address;
    • Optional display name (welcome email);
    • Magic-link URLs (early-access invite emails);
    • Email HTML and plain-text content.
    • Waitlist audience contacts (email, subscription status) when granting early access via admin scripts.
  • Region: United States.
  • Notes: Sender identity: Shin <hi@shin.chat>, reply-to hi@shin.chat. Login magic links for day-to-day sign-in are sent via Supabase Auth, not Resend.

Vercel, Inc.

  • Purpose: Application hosting, serverless function execution, CDN, and request routing for the shin.chat web application.
  • Data categories:
    • HTTP request metadata (IP address, user agent, URL, timestamps, response codes);
    • Server-side application logs generated during request handling;
    • Any personal data processed by the application during a request (transiently, in memory).
  • Region: United States and global edge network (per Vercel deployment configuration).
  • Notes: Inferred from Next.js deployment patterns and Sentry/Vercel integration in our build configuration. Confirm production deployment target in your Vercel dashboard.

3. AI Provider Training Policy

Under our commercial API agreements with Anthropic, Google, and OpenAI:

  • Content you submit through shin.chat is processed to generate responses and indexes for your use of the Service.
  • It is not used to train their public foundation models by default.
  • We do not opt your data into provider training or development partner programs through the Service.

Provider-side API log retention for trust, safety, and abuse monitoring may apply for a limited period (typically on the order of days). That retention is governed by each provider’s commercial API documentation, not by shin.chat’s database retention.

4. Changes to This List

We may add, remove, or replace subprocessors as the Service evolves. When we make material changes, we will update this page and the “Last updated” date. Where required by law or contract, we will provide additional notice before a new subprocessor processes personal data.

If you are an enterprise customer with a data processing agreement that requires prior notice of subprocessor changes, contact privacy@shin.chat.

5. Contact

Questions about subprocessors or data processing: