Third-Party Services & Subprocessors

AI requests are routed through a managed inference layer (Emergent) under equivalent contractual restrictions. Anthropic (Claude) models are available through the same gateway and, where used, operate under the same restrictions.

• OpenAI (US) — generates assistant responses, briefings, drafts, research reports, voice transcription (speech-to-text), spoken audio (text-to-speech) and video (Sora). Receives prompts and permission-filtered context; not permitted to train on your content.
• Google (US) — same role and restrictions for Gemini-powered responses and image features.

• Google LLC — Gmail, Calendar, Drive, Contacts, Tasks and Meet APIs. Panzoe reads the data you authorise and writes only what you explicitly approve (e.g. saving a draft). Use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.
• Microsoft Corporation — Microsoft Graph for Outlook Mail & Calendar, OneDrive, To Do, Teams metadata and Contacts, under the same read/approve-to-write model.

• Stripe (US/global) — subscription payments made on the web. Processes card details entirely on Stripe infrastructure; Panzoe never stores card numbers.
• Apple Inc. & Google LLC — in-app purchases made inside our iOS and Android apps are processed by the App Store and Google Play respectively; Panzoe receives only purchase verification records, never your payment details.
• Resend (US) — transactional email delivery (verification, receipts, briefing emails). Processes recipient address and message content.
• Slack Technologies (US) — only if you connect Slack: receives the specific briefings or research summaries you choose to send to your Slack workspace. Your webhook credentials are encrypted at rest and deleted on disconnect.
• Google Analytics & Google Ads (US) — website measurement only, and only after you accept analytics cookies; IP anonymisation enabled; never loaded in our mobile apps.

• Managed cloud hosting and MongoDB database infrastructure — stores platform data with TLS in transit; OAuth tokens are additionally application-layer encrypted.
• Managed object storage (Emergent) — stores files you upload (such as avatars) and generated media assets.
• Web push delivery (your browser's push service — e.g. Google, Apple or Mozilla) — receives only the notification title and body you opted into.

We update this list before adding processors that handle personal data. Questions: privacy@panzoe.ai.