Subprocessor and Service Provider List

1. Product subprocessors

Google Cloud / Firebase — authentication, Firestore data storage, application infrastructure and EU-located BigQuery storage for allowlisted server-owned product milestone analytics.

Vercel — application hosting, serverless execution and operational delivery.

OpenAI — AI-supported processing requested through AffinityAI, including speech transcription and text generation. OpenAI states that API inputs and outputs are not used for model training by default unless the customer opts in. Standard abuse-monitoring retention of up to 30 days may apply; Forito does not claim that Zero Data Retention or Modified Abuse Monitoring is enabled for the current account.

Resend / Plus Five Five, Inc. — transactional email delivery.

2. Payment and authentication providers with separate roles

Stripe — checkout, billing, payment processing, tax and invoicing; Stripe may act as an independent controller for parts of payment processing.

Google Sign-In — account authentication and basic profile information requested by the user.

3. Forito controller-side providers

Attio and Clay may support Forito’s business-contact and sales operations outside Customer Content. Apollo is not active in the current verified workflow.

Google Analytics 4 measures consented traffic, campaign attribution and allowlisted interactions on approved public marketing pages. It does not receive Customer Content or direct AffinityAI account, workspace, Scenario or participant identifiers, and it is not used here for advertising, personalization or retargeting.

Controller-side providers are not permitted to receive Customer Content through AffinityAI product flows.

4. Changes

Forito will update this list before materially changing product subprocessors and will provide notice where the DPA requires it.

5. Contact

privacy@affinityai.app