Sub-processors and recipients

Version 1.0. Effective 28 October 2026.

This page lists the providers that receive personal data from us or through the Services, what each does, what it receives, where it handles data, and whether it acts for us or on its own account. It supports section 9 of the Privacy Policy and the Data Processing Addendum.

1. How to read this page

A sub-processor is a provider that handles personal data for us, on our instructions. An independent provider decides for itself why and how it uses what it receives, under its own terms, and its own privacy policy applies. Where we could not yet confirm a provider's role from its own terms, the role column says "To be confirmed".

The Data Processing Addendum for business customers covers only personal data that we process on a customer's behalf. Of the providers below, that means Amazon Web Services, Resend and Google Workspace and, for a business customer's support cases that our AI agent answers, the AI and voice providers in section 2. Google Analytics receives data about website visitors for our own purposes.

Dictation, History, notes, snippets, vocabulary, prompts, tasks and Assistant chats stay on your computer. None of the providers below receives them from us. The AI and voice providers in section 2 receive what a person writes or says to our AI agent on the website, and what a signed-in customer writes in a support case.

When the analytics and advertising providers load. Google Analytics, Microsoft Clarity, Google advertising and Meta Pixel load according to the visitor's region, as the Cookie Policy explains. In the EU, the EEA, the UK, Switzerland and every other place except India and the United States, they load only after the visitor accepts them in the cookie box. In India and the United States they load by default and stop when the visitor presses "Necessary only" or the browser sends the Global Privacy Control signal.

2. Providers that act for us

Name	What it does for us	Personal data it receives	Where it handles data	Role	Terms or privacy policy
Amazon Web Services	Hosts the Website and its database, and holds our backups	The data the Website holds: account, purchase, licence, computer, support and security records (Privacy Policy, section 3)	India (Asia Pacific (Mumbai) region)	Sub-processor	Privacy notice, GDPR centre
Resend	Sends all our email: sign-in and verification links, licence emails, receipts, gift offers, support replies and confirmations of contact messages, and our news, offers and product emails	The recipient's address, and the subject and text of each email, which can include a licence key or a link	United States	Sub-processor	Privacy policy, Data processing addendum
Anthropic	Writes the AI agent's replies on the website and in Support, when we have chosen its Claude models. We choose which provider answers in our own settings, so at any time one or more of Anthropic, OpenAI, Google and Groq do	The conversation so far, the page the visitor is on, whether they are signed in and, for a signed-in or verified person, a short summary of their account. Never a licence key, a password or card details (Privacy Policy, section 5.4)	The United States and other countries where it operates	Sub-processor, under its commercial terms	Privacy policy, Commercial terms
OpenAI	Writes the AI agent's replies, when we have chosen its models	The same as for Anthropic	The United States and other countries where it operates	Sub-processor, under its business terms	Privacy policy, Business terms
Google (Gemini)	Writes the AI agent's replies, when we have chosen its Gemini models	The same as for Anthropic	Various, as Google's terms say	Sub-processor, under its terms for paid services	Gemini API terms, Google privacy policy
Groq	Writes the AI agent's replies, when we have chosen a model that it runs	The same as for Anthropic	The United States and other countries where it operates	To be confirmed	Privacy policy
Retell	Runs the voice call with the AI agent: it receives your voice as you speak, turns it into text, passes the text to an AI model, and turns the answer into speech. It uses its own providers for speech and for the AI model, as its terms say	Your voice during the call, the words of the call, the page you were on and whether you were signed in. We have told it not to keep a recording, a transcript or logs beyond basic details such as the length of the call	The United States and other countries where it operates	Sub-processor, under its business terms	Privacy policy
Google Workspace	Our team's email and office tools	Messages and attachments that you send to our support, privacy, legal and security addresses or through the Contact page, and our replies	Various, as Google's terms say	Sub-processor	Google privacy policy
Google Analytics	Counts visits and shows which pages and downloads are used. Loads according to your region (see above)	Pages visited, clicks on download buttons, cookie identifiers, and the address and browser details that your browser sends	Various, as Google's terms say	Sub-processor, under Google's data processing terms	Analytics terms, Data processing terms, Google privacy policy

3. Providers that act on their own account

Name	What it does	Personal data it receives	Where it handles data	Role	Terms or privacy policy
Razorpay	Takes payments and refunds	The payment details you type into Razorpay's window. From us: the order amount and currency, a reference, your email address, the product and quantity, any coupon, and the GST amount	India, and elsewhere as its privacy policy says	To be confirmed	Terms, Privacy policy
Google (sign-in)	Lets you sign in with your Google account	We receive your email address, name, profile picture address and whether Google has verified the address. Google learns that you sign in to our Website	Various, as Google's terms say	Independent	Google privacy policy
Google (advertising)	Measures and shows our ads on Google. Loads according to your region (see above). Also hosts the lead forms that we run on Google Ads, where you give us your contact details	Your visit to our Website, ad-click information, cookie identifiers, and the address and browser details that your browser sends. For a lead form, what you type into it, which Google passes to us under its own terms	Various, as Google's terms say	To be confirmed. For lead forms, Google is a separate controller for its own handling	How Google uses data from sites that use its services, Google ad settings, Google Ads policies
GitHub	Lets you sign in with your GitHub account	We receive your verified email address, name and profile picture address. GitHub learns that you sign in to our Website	The United States and other countries, as GitHub's statement says	Independent	Privacy statement
Microsoft Clarity	Records how people use our pages (clicks, scrolling and layout) so that we can fix confusing screens. Loads according to your region (see above). Text you type is masked, and we do not use it on account, checkout or support pages	How you use the page, cookie identifiers, and the address and browser details that your browser sends	Various, as Microsoft's terms say	Independent	Terms, Microsoft privacy statement
Microsoft Store	Distributes the App to people who install it from the Store	Microsoft handles the download under its own terms. We receive only what Microsoft's reports show us	As Microsoft says	Independent	Microsoft privacy statement, Store policies
Meta	Measures and shows our ads on Facebook, Instagram and the other places Meta shows ads. Loads according to your region (see above). Also hosts the lead forms that we run on Facebook and Instagram, where you give us your contact details	Page views, download clicks, cookie identifiers, ad-click information, and the address and browser details that your browser sends. For a lead form, what you type into it, which Meta passes to us under its own terms	Various, as Meta's terms say	Independent. Meta's terms also treat Meta and us as joint controllers for the collection of this data. For lead forms, Meta is a separate controller for its own handling	Privacy policy, Terms, Advertising standards
AppSumo	Sells licences on its marketplace and passes us the key	If you buy through AppSumo, we receive your licence key, plan and redemption status. AppSumo handles your purchase and payment	As AppSumo's terms say	Independent	Terms of use
Hosting services for AI model files	Serve the AI model files that the App downloads when you press a download button	Your IP address and the request	Various	Independent	Their own terms

4. Cloud AI providers that you may choose yourself

The App can send audio or text to Groq, OpenAI or Anthropic, but only if you save your own key with that provider and choose it in the App. For that use these providers are not our sub-processors. We do not provide the keys, accounts or servers, and the data goes straight from your computer to the provider, under your agreement with it. We do not receive it. (The same companies also answer the AI agent on our website under our own accounts, which section 2 describes. That is a separate use.) Read the provider's terms before you switch it on:

The AI and Third-Party Services Notice explains what each choice sends.

5. How we tell you about changes

When we change this page we update the date at the top. We email business customers at least 30 days before a new sub-processor starts to handle their data, and a business customer can object, as section 5 of the Data Processing Addendum says. Where a provider's own supplier gives us less notice, we tell business customers as soon as we learn of the change.

6. Last updated and contact

Last updated 28 October 2026. Questions: privacy@dictatesafe.com, or the Contact page at https://dictatesafe.com/contact.

Document history

Version	Date	What changed
1.0	28 October 2026	First version in this form.