1. Subprocessors
| Provider | Purpose | What it receives | Where | Optional? |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage for legacy uploads | Everything at rest: account, content, ledgers, encrypted connected-account tokens. | One Supabase Cloud region, fixed when the hosted project was created. | No — it is the datastore. |
| OVHcloud Object Storage | Uploaded files and generated media | The files themselves, keyed by your account id. No metadata beyond content type. | Canada (Toronto, ca-east-tor) for the hosted service. | No for hosted; self-hosted deployments may point at any S3-compatible store. |
| PoYo | Model gateway for chat and image, video, audio, 3D generation | The prompt and the context you attached to that request, and generation prompts. Nothing you did not put in a prompt. The Context Inspector shows the exact payload per turn. | Routed to the selected model provider for the duration of the request. | Yes — with no key, chat and generation are unavailable. |
| ToAPIs (backup gateway) | Equivalent-model chat and selected image/video failover when PoYo is busy or unavailable | The same request prompt and bounded context, including screen images or source files when attached. Upstream providers receive the request as needed. | Provider and upstream regions depend on the route; no fixed processing region is promised here. | Yes — unset TOAPIS_API_KEY or disable TOAPIS_CHAT_FALLBACK and TOAPIS_MEDIA_FALLBACK. |
| Groq (speech-to-text) | Transcribing dictation and meeting audio when the Groq transcription endpoint is configured | Audio explicitly recorded or uploaded for transcription, language, and an optional vocabulary hint. | The configured Groq API endpoint and applicable provider terms. | Yes — a different transcription endpoint can be configured. With no configured provider, transcription is unavailable. |
| Slack, Notion, GitHub, YouTube and Stripe Connect | Connected-account history reads and actions you review and confirm | OAuth grants and API requests. History is imported privately into your workspace and relevant excerpts can be included in assistant context. Posting, page edits, issue creation and private video upload occur only after review. | Each connected account provider’s services. | Yes — only after you connect. Disconnect deletes our stored token and imported connector history. |
| Jina AI | Embeddings for search and document retrieval; web search for research | Title and plain text of documents queued for indexing, search query text, and research queries. Not formatting, attachments, images, or version history. | Jina’s API endpoints; requests are not retained after processing per their API terms. | Yes — with no key, nothing is sent and search falls back to keyword matching. |
| OpenAI (speech-to-text) | Optional meeting speaker diarization or speech-to-text when configured | The audio file of a meeting you chose to transcribe, and its title as a vocabulary hint. Nothing else. The transcript and notes are stored in your workspace, not with the provider. | OpenAI's API (US). A self-hosted deployment can point this at a local Whisper server instead, in which case nothing leaves the machine. | Yes — with no transcription provider configured, recordings queue and the page says so. |
| Stripe | Payments, subscriptions, invoices, tax | Email, billing address, card details (entered on Stripe’s pages, never ours), plan and invoice history. | Stripe’s infrastructure (US/EU). | Yes — with no key there is nothing to buy. |
| Google, Microsoft, Apple | Sign-in and calendar sync, only when you connect them | OAuth grants for the scopes you approve; calendar events flow both ways when sync is on. Apple uses an app-specific password over CalDAV. | Their services, under your own account with them. | Yes — off until you connect, revocable in Settings › Integrations. |
| Resend / SMTP | Transactional email: invitations, mentions, sign-in and reset links | Recipient address, subject, and the message body of that email. | Resend (US) or the SMTP relay configured for the deployment. | Yes — with neither configured, the email is skipped and the invitation link is shown to the inviter to pass on. |
| Upstash | Rate limiting | An account id (or, for public endpoints, an IP address) and a request counter. No content. | Upstash regional Redis. | Yes — without it, rate limits are not enforced. |
| Vercel | Cookieless page-view analytics; preview deployments | Page views: path, referrer, country, device class, browser. No identifiers, no content. On preview deployments it hosts, request traffic as well. | Vercel edge network. | The production application runs on our own servers (OVHcloud). Page-view analytics is aggregate and not tied to an account; it is not currently switchable per user. |
2. How a request flows
- You type or attach something. It is saved to the database (Supabase) under your account, protected by row-level security.
- You ask Jaime. The prompt and the context you explicitly attached — shown in the Context Inspector — go to the model gateway (PoYo), which forwards them to the model. The answer comes back and is stored with a receipt naming the model.
- You save a document. A background job sends its title and text to Jina and stores the resulting vector next to the document. Deleting the document deletes the vector.
- You generate media. Credits are reserved, the prompt goes to the gateway, the result is written to object storage under your account id, and the reservation is captured or released.
- An agent acts. It runs inside the permissions you granted, pauses for approval on side effects, and writes every step to the trust ledger. Connected services are called with the token you authorised.
- You pay. Checkout happens on Stripe’s pages. Stripe tells us the outcome through a signed webhook; we record the plan and add credits to your ledger. Card numbers never reach us.
3. What is not here
- No advertising networks, no cross-site trackers, no data brokers.
- No model training on your content, by us or by anyone we send it to.
- No third-party error-tracking or session-replay service at this time; errors are logged on our own servers with prompts and content redacted.
- Desktop capture (dictation, selection actions) goes through the same gateway as chat and nowhere else; a verified local model is labelled “on device” and sends nothing.
4. Self-hosted and desktop editions
If you run Jaime on your own infrastructure, you choose every provider above and are the controller of the data; this page describes our hosted service only. The free desktop edition sends requests directly from your machine to the provider whose key you entered, and nothing to us.
5. Changes to this list
We add a row before a new provider receives production data and give signed-in users 30 days’ notice in the app for any provider that will see content (as opposed to infrastructure metadata). If you object, you may delete your account before the change takes effect. Questions or a request for a data-processing agreement: privacy@askjaime.xyz. See also the Privacy Policy.