Service Providers, Sub-Processors and Independent Controllers
Last Updated: July 24, 2026
This document is only available in English.
Delph-AI uses the following third-party service providers to operate the Service. Some providers act as sub-processors (processing data on our instructions), while others — particularly payment providers — act as independent controllers for their own purposes. The contractual and data-protection arrangements applicable to each provider vary by service and are described in the table below. Where a provider's data processing agreement or no-training commitment has not been verified for our integration, we indicate this explicitly.
We will update this page when we add or change sub-processors. If you wish to be notified of changes, please contact privacy@delph-ai.org.
AI Model Providers
Delph-AI does not intentionally transmit user account identifiers, contact details, or billing information to AI model providers. Model inputs are limited to bibliographic content (titles, abstracts) and screening criteria. Bibliographic content may incidentally contain personal data present in the source material.
| Provider | Purpose | Data Processed | Location | Transfer Mechanism | DPA |
|---|---|---|---|---|---|
| Google (Vertex AI) | AI model inference — Gemini native models and partner models (Meta Llama, Alibaba Qwen) via Model-as-a-Service | Titles, abstracts, criteria | Belgium for Gemini 2.5 series; United States or global processing without EU-only residency guarantee for Gemini 3.x and partner models | Processing within the EEA for Gemini 2.5; SCCs + DPF for US/Global-processed models | Cloud Data Processing Addendum |
| OpenAI | AI model inference (GPT-4.1 and GPT-5 series) | Titles, abstracts, criteria | US | SCCs + DPF | Data Processing Addendum |
| Anthropic | AI model inference (Claude series, currently including Haiku 4.5, Sonnet 4.6, Opus 4.6, Sonnet 5, Opus 4.8) | Titles, abstracts, criteria | US | SCCs | Commercial Terms DPA |
| Mistral | AI model inference (Mistral series, currently including Small 4, Large 3, Medium 3.5) | Titles, abstracts, criteria | EU (Paris, France) | Processing within the EEA; no third-country transfer | Data Processing Addendum |
| xAI | AI model inference (Grok series, currently including Grok 4.3, Grok 4.3 Thinking, Grok 4.5) | Titles, abstracts, criteria | US | SCCs | Data Processing Addendum |
| DeepSeek — Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (direct API) | AI model inference (DeepSeek V4 Flash, V4 Flash Thinking, V4 Pro, V4 Pro Thinking) via api.deepseek.com | Titles, abstracts, criteria (bibliographic data only — no user account data) | People's Republic of China | No adequacy decision; data processed in People's Republic of China. No-training commitment not yet contractually confirmed. Contractual and transfer review in progress. | DeepSeek Open Platform Terms (DPA review in progress) |
| Meta Platforms, Inc. — model developer; accessed through Google Vertex AI MaaS | AI model inference (Llama 4 Scout, Llama 4 Maverick) | Titles, abstracts, criteria (bibliographic data only — no user account data) | United States (us-east5, via Vertex AI) | SCCs + DPF (via Google Cloud agreement) | Governed by Google Vertex AI terms for partner models |
| Alibaba Cloud — model developer; accessed through Google Vertex AI MaaS | AI model inference (Qwen3 235B, Qwen3-Next 80B) | Titles, abstracts, criteria (bibliographic data only — no user account data) | United States (us-south1) / Global (via Vertex AI) | SCCs + DPF (via Google Cloud agreement) | Governed by Google Vertex AI terms for partner models |
Note on no-training status: We use contractual restrictions, provider settings, or routing controls to prevent training or non-transient data retention where these protections are available and verified for each provider. For Google, OpenAI, Anthropic, Mistral, and xAI, no-training commitments have been confirmed through executed data processing agreements. For DeepSeek, no-training status is under review; we do not represent a no-training commitment for DeepSeek until it is contractually confirmed or technically enforced. Meta and Alibaba models are accessed via Google Vertex AI Model-as-a-Service; Google's processing is governed by the Cloud Data Processing Addendum, and model-specific terms apply to each partner model.
Note on model versions: We list model families and series; specific minor versions within a family may be updated without prior notice to ensure performance and security. This page reflects currently enabled model families and is updated when families are added or removed.
Infrastructure and Services
| Provider | Purpose | Data Processed | Location | Transfer Mechanism | DPA |
|---|---|---|---|---|---|
| Google Cloud Platform | Hosting (Cloud Run, Cloud SQL), storage | All service data | EU (Belgium — europe-west1) | Processing within the EEA; no third-country transfer | Cloud Data Processing Addendum |
| Firebase (Google) | User authentication | Firebase UID, email, auth tokens | US | SCCs + DPF | Firebase Data Processing Terms |
| Resend | Transactional email delivery | Email address, email content | US | SCCs | Data Processing Agreement |
Payment Providers and Independent Controllers
Note: Some payment providers listed below act as independent controllers for their own payment, tax, fraud, compliance, refund, and chargeback purposes, not as sub-processors of Delph-AI. We identify each provider's role to avoid confusion. A provider listed as an independent controller is not a sub-processor of Delph-AI for the data it handles in that capacity.
| Provider | Purpose | Data Processed | Role | Location | Transfer Mechanism | Legal Terms |
|---|---|---|---|---|---|---|
| Dodo Payments Inc. | Primary Merchant of Record — checkout, payment collection, tax calculation, invoicing, fraud screening, refunds, chargebacks | Buyer name, email, billing address, billing country, tax ID, order/subscription IDs, transaction amount, currency, payment method type, purchase history | Independent controller for buyer/payment/tax/fraud/compliance data. Processor only for supplier-specific analytics on documented instructions. | US (Delaware) | SCCs + UK Addendum. DPF where Dodo maintains valid certification. | Data Processing Agreement |
| Paddle | Backup Merchant of Record — checkout, payment collection, tax calculation, invoicing, fraud screening, refunds, chargebacks | Buyer name, email, billing address, billing country, tax/VAT ID, order/subscription IDs, transaction amount, currency, payment method type, purchase history | Independent controller for buyer/payment/tax/fraud/refund/chargeback data. Data sharing with Delph-AI governed by Data Sharing Addendum. | US / Canada / UK (contracting entity varies by buyer location) | Adequacy / SCCs / UK transfer mechanisms as applicable | GDPR Readiness + Data Sharing Addendum |
| Payoneer | Business payout provider — receives settlement payments from MoR and pays Delph-AI | Delph-AI founder/business identity, KYC data, bank account details, settlement amounts, payout references. NOT end-user payment card data. | Independent controller for payout, KYC, and compliance data. Not part of Delph-AI checkout. Does not interact with end users. | US | Controller-to-controller terms | Controller-to-Controller DPA |
Transfer Mechanisms Explained
| Mechanism | Description |
|---|---|
| SCCs | Standard Contractual Clauses — legal contracts approved by the European Commission (Implementing Decision 2021/914) that ensure adequate data protection when transferring data outside the EEA |
| DPF | EU-US Data Privacy Framework — a framework that allows certified US companies to receive personal data from the EEA based on an adequacy decision by the European Commission |
| Processing within the EEA | The sub-processor processes data within the European Economic Area; no third-country transfer under GDPR Chapter V applies for this processing location |
Changes to This List
We review our sub-processors regularly. When we add a new sub-processor or make a material change, we will:
- Update this page with the new sub-processor's details;
- Note the date of the change;
- Notify users who have requested change notifications via email.
If you have concerns about a new sub-processor, please contact us at privacy@delph-ai.org.
Contact
For questions about our sub-processors or data processing practices:
- Privacy: privacy@delph-ai.org
- Security: security@delph-ai.org