Back to home
Subprocessors
Last updated: October 11, 2026
The third-party service providers ("subprocessors") that Chask uses to operate the Service. For full context, see our Privacy Policy — this page is the authoritative source for who receives what data.
Current subprocessors
OpenAI
- Purpose:
- LLM provider for goal breakdown, planning, milestones, chat, and content generation, embeddings for help-chat search, and goal images. Models: gpt-5.4-mini, gpt-5.4; embeddings: text-embedding-3-small; images: gpt-image-1.
- Data shared:
- Goal content, task descriptions, chat messages (including help-chat questions), About-me profile context, milestone structure, scheduling windows, story extracts, and the goal statement (with any description you add) when you generate a goal image.
- Processing location:
- United States
- Transfer mechanism:
- Standard Contractual Clauses; OpenAI API customer data is not used to train models by default.
Anthropic
- Purpose:
- LLM provider for our support-triage tools: classifying support messages and feedback, assessing severity, summarizing account context, extracting reproduction steps, answering help questions from our documentation, and drafting replies a team member reviews. Models: claude-sonnet-5.
- Data shared:
- Support conversations, feedback text, help questions that reach our team, and the account details used to answer them (such as plan and payment status).
- Processing location:
- Stored in the United States; processed in the United States, Europe, Asia, or Australia
- Transfer mechanism:
- Standard Contractual Clauses; Anthropic's commercial terms do not permit it to train models on API customer content.
Supabase
- Purpose:
- Primary database, authentication, real-time, and file storage.
- Data shared:
- Account profile, goals, tasks, milestones, journal notes, workspace data, OAuth tokens (encrypted at rest).
- Processing location:
- United States (AWS)
- Transfer mechanism:
- Standard Contractual Clauses
Sentry
- Purpose:
- Error monitoring and performance tracing; session replay only with analytics consent.
- Data shared:
- Stack traces, request paths, IP address, browser metadata, Chask context tags (UUIDs). Authorization headers, cookies, and goal/NLP request bodies are scrubbed before send. Session replays, when consented to, mask all text and input and block media.
- Processing location:
- United States
- Transfer mechanism:
- Standard Contractual Clauses; EU-US Data Privacy Framework
PostHog
- Purpose:
- Product analytics and session recording (opt-in only). Autocapture is disabled; recordings mask all input.
- Data shared:
- Aggregated feature-usage events, page views, opt-in event metadata.
- Processing location:
- United States or European Union (depending on cluster)
- Transfer mechanism:
- Standard Contractual Clauses; EU-US Data Privacy Framework
Google (Calendar OAuth)
- Purpose:
- Calendar integration: read and write events you authorize.
- Data shared:
- OAuth refresh and access tokens (encrypted at rest with AES-256-GCM); calendar event payloads you authorize.
- Processing location:
- United States; Google global infrastructure
- Transfer mechanism:
- EU-US Data Privacy Framework; Standard Contractual Clauses
Stripe
- Purpose:
- Payment processing and subscription management.
- Data shared:
- User ID, workspace ID, selected tier, billing amount, Stripe customer ID. Card numbers are never sent to Chask.
- Processing location:
- United States
- Transfer mechanism:
- Standard Contractual Clauses; EU-US Data Privacy Framework
Resend
- Purpose:
- Transactional email delivery (verification, password resets, account notifications).
- Data shared:
- Recipient email address, sender, subject, message body.
- Processing location:
- United States
- Transfer mechanism:
- Standard Contractual Clauses
Redis-compatible cache
- Purpose:
- Short-lived caching of AI responses to reduce LLM calls (default TTL 30 minutes).
- Data shared:
- Request keys derived from input parameters; generated AI outputs.
- Processing location:
- United States (co-located with primary infrastructure)
- Transfer mechanism:
- Internal infrastructure; no third-party transfer
Bring-your-own-key AI providers
A workspace owner or admin can connect the workspace's own OpenAI or Anthropic API key in the workspace's AI settings. That workspace's AI requests then go to that provider on the workspace's key, under the workspace's own agreement with the provider. See §3(b) of our Privacy Policy.
Notification of changes
We update this page whenever we add, change, or remove a subprocessor. To receive change notifications by email, contact privacy@chask.ai with the subject line "Subscribe to subprocessor change notifications".
For Data Processing Agreements with Chask, email legal@chask.ai.