Legal
Subprocessors
Last updated
Hosted Louvain relies on the providers below. Each is bound by written terms that include data protection obligations. This list applies to the hosted service at louvain.ai; a deployment you run yourself uses whichever providers you configure.
How to use this list
Louvain AI Ltd, which operates Louvain, engages these providers as subprocessors under our Data Processing Addendum. The first table lists providers that process Customer Data — the content you connect and the questions you ask. The second lists providers that process account, billing and website data, for which we are the controller as described in our Privacy Policy.
"Location" is where the provider processes the data for Louvain. Model providers reached through a gateway can process a request in the locations of the upstream provider that serves it.
Customer Data
| Provider | What it does for Louvain | Data it receives | Location |
|---|---|---|---|
| Fly.io, Inc. | Hosts the Louvain application, background workers, search index, embedding and language services, the permission store, and the authorisation broker that holds sign-in tokens for connected sources | All Customer Data processed by the Service, and OAuth tokens for connected sources | European Union (Frankfurt) |
| Neon, Inc. | Managed PostgreSQL database | All stored Customer Data, including imported content, derived facts and search vectors, questions, conversations, audit records and encrypted connector credentials | European Union (AWS eu-central-1, Frankfurt) |
| OpenRouter, Inc. | Model gateway. Routes requests to the language models that read sources, answer questions, run the Ask assistant and write Today briefings, the Plate and meeting briefs, and the vision model that transcribes the text in a picture the built-in reader can barely read; also routes the document reranker and web search requests below | The text needed for each task: passages from your sources, the question and the conversation; and, to transcribe a picture, the picture itself (unless a workspace administrator turns this off) | United States, and the locations of the upstream model provider that serves each request |
| Upstream model providers (through OpenRouter) | Run the models. At the date above the Service's configured defaults are: for reading sources into facts, DeepSeek's V4.1 Flash, with Z.ai's GLM-5.3 Flash checking each fact and each ending a source states (both open-weight, and for this reading never served by the model makers' own services, by any provider hosting in the People's Republic of China, or by any provider that retains prompts); for answering and for Today and meeting briefings, OpenAI's GPT-6 models (not open-weight) — GPT-6.1 Sol by default and GPT-6 Luna for quick answers — with Qwen and DeepSeek models (open-weight) offered as alternatives in the Ask assistant; for checking the sentences of an answer, a Qwen model (open-weight); and for transcribing the text in pictures, Qwen3-VL (open-weight, under the same rules as reading sources: never the model maker's own service, a provider hosting in the People's Republic of China, or a provider that retains prompts). OpenRouter chooses which of the providers hosting a model serves each request, so the serving provider can vary; we name the model families in use and the providers they can be served by on request at legal@louvain.ai | The same text, or picture, as OpenRouter, for that request | Varies by provider; primarily the United States |
| Cohere Inc. (through OpenRouter) | Reranks candidate documents so the most relevant are read first | The question and the opening portion of up to 30 candidate documents the asker can read | Varies by serving region; primarily the United States |
| Groq, Inc. | Runs a small, fast model that classifies each question's shape and checks whether sentences in an assistant reply are advice or statements | The question, and sentences of the assistant's reply, which can include names and figures from your sources | United States |
| Exa Labs, Inc. (through OpenRouter) | Web search for the Ask assistant — only when a workspace administrator turns web search on. It is off by default | Search queries the assistant writes from the conversation | United States |
| TypeSafe (api.typesafe.ai) | Checks the kind of each entity Louvain records (a person, an organisation, a project) — only when a workspace administrator turns the classifier on, off by default; and answers the workspace's decisions: what a question asks for, whether a sentence of an answer stands, whether a mail was generated by a machine, which earlier chat message an unthreaded one continues, and which of a person's own plate categories an item belongs in. Decisions go to TypeSafe only for a workspace using the hosted decision model on its own key (set by a workspace administrator), or on Louvain's deployment key where one is configured; a workspace with neither sends nothing to TypeSafe for decisions | For entity kinds: the name of an entity and the list of kinds it could be — no source text, containers, addresses or other names. For decisions, only the text each one reads, never stored by Louvain: (1) about a question — the question as written, and for whether it names a specific thing, a phrase taken from it; when the model is left on Auto, also up to four earlier questions in the same conversation (each up to 300 characters); (2) about an answer — whether a source is about what was asked: the question and up to the first 1,000 characters of each source passage a removed sentence rests on, including the other passages shown of a document it cites (at most twelve per answer); whether an answer leaves the question open: the question (up to 500 characters) and the written answer (up to 1,500); how a sentence of an answer is read: up to six of its sentences (each up to 1,000 characters), today's date and the dates of the sources they cite; whether a source states what an answer says the records lack: that sentence and up to 1,500 characters of the source; (3) about a mail, at ingest — for a mail every other rule reads as a person's whose envelope sender is on another domain than its From, or whose From is shaped like a billing, invoices or orders mailbox nobody in the mailbox has written to: the From address, the envelope sender (which for some mailings contains the recipient's address), the List-Id, Precedence and Auto-Submitted header values, whether a List-Unsubscribe header is present, and whether anyone in that mailbox has written to the sender — never the subject, the body or other recipients; (4) where a workspace turns on leaving out sources that do not help answer: the question and up to about 2,800 characters of each source on an answer's page; (5) about unthreaded chat, at ingest — for a Slack or Teams message posted on its own rather than as a thread reply: its text and that of up to eight earlier such messages in the same channel or DM, each with the name its author is shown under, to decide which one it continues; Louvain keeps only which message it continues and the model's probabilities, never the text; (6) for a person who wrote their own plate categories: an item's line on their plate and its source's title, with the name, description and examples of up to ten of their categories, to decide which ones it belongs in; Louvain keeps which categories it is in and the model's probability, never the text. Some are asked on a sample of answers to measure them before they change anything | Available on request at legal@louvain.ai |
| RunPod, Inc. | Can run Louvain's own open-weights decision model on a GPU that starts when needed, for a deployment that configures it; not in use on Louvain's hosted service as of 5 October 2026. The model reads each question to decide what form of answer it wants (a count, a list, the asker's own work), for a decision that checks an answer, whether a source passage an answer rests on is about what the question asks; and, where a workspace turns it on, how useful each source on an answer's page is to the question. The model keeps nothing between requests; RunPod's queue holds each request until it runs (at most 10 seconds) and keeps the result for RunPod's own result-retention window | Where configured, the same text each decision reads as listed for TypeSafe above | The data-centre region the endpoint is configured in; available on request at legal@louvain.ai |
| Functional Software, Inc. (Sentry) | Error monitoring | Error types, stack traces and bounded diagnostic tags, including the identifier of the workspace an error occurred in (never a person's). When a page of the product fails in a person's browser, our servers relay only the error's class, the kind of page it happened on and its reference number — never what the page showed. Request bodies, questions and source content are never sent, and error messages are stripped of quoted values, email addresses and identifiers before they leave our servers. Feedback a person chooses to send from the product — their words, any screenshot they add, their account and workspace identifiers, the kind of page and the app's version — is delivered to us through Sentry | United States |
| Grafana Labs (Raintank, Inc.) | Stores the Service's operational metrics and evaluates the alerts that tell us when it is failing | Counts, durations and outcomes labelled only by route template, component and result. Workspace and person identifiers are removed before a metric is recorded, and no source content, questions, names or email addresses are sent | United Kingdom (AWS eu-west-2, London) |
| GitHub, Inc. | Runs the scheduled job that backs up the database | All stored Customer Data, read from the database for the length of the job only. The copy is encrypted before it leaves the job's machine, and the machine is discarded when the job ends | United States |
| Resend (Plus Five Five, Inc.) | Delivers email about a workspace's content. Discussion notifications: by default when someone is mentioned or a thread they follow gets a reply, and — only if that person turns them on — Louvain's answers to their questions and their threads being resolved. And, only if a person turns it on for a workspace, a weekly digest and a reminder on the day items are due, drawn from their own to-do list as they can read it when the email is sent | The recipient's email address. In a discussion notification, unless a workspace administrator turns names off: the name of the person who acted and the names of the document and the collection; never the text of a comment or reply. In a digest or a due reminder, unless a workspace administrator turns names off: each to-do item's words (at most 140 characters) and its due date; never an excerpt of a source, the other person involved, or a source's subject. Where names are off, these emails carry no names and no item words | United States (account data, delivery logs and message metadata); messages are sent from the European Union (Ireland) |
| Tigris Data, Inc. | Stores the encrypted database backups | The encrypted backup files. The keys that decrypt them are held by us, not by Tigris | United States, and other regions where Tigris stores objects |
Browser push services are not on this list because your browser chooses them, not us. If you turn on notifications on a device, each one travels through the push service your browser's maker runs for it (Apple for Safari, Google for Chrome, Mozilla for Firefox, Microsoft for Edge), chosen by your browser, not by us. What it carries is a title of up to 60 characters, a line of up to 140 and the page of the app it opens, encrypted to that device before it leaves our servers, so the push service carries bytes it cannot read; it sees the device's push address, when a notification was sent, its size and an opaque tag, and is asked to discard it after 24 hours if it cannot be delivered.
Account, billing and website data
| Provider | What it does for Louvain | Data it receives | Location |
|---|---|---|---|
| Clerk, Inc. | Sign-in and account authentication for hosted Louvain, including sign-in and verification emails | Names, email addresses, sign-in method and identifiers, session and device information, IP addresses | United States |
| Stripe, Inc. | Payments, subscriptions, invoices and tax calculation | Billing contact details, company details, payment card and bank details (held by Stripe, not by us), subscription and invoice records | United States, and other locations where Stripe operates |
| PostHog, Inc. | Product analytics and error monitoring recorded by our servers, and — only where a visitor allows it — usage measurement on our public website | From our servers: a fixed set of product events, such as a connection being created or an answer being returned, each carrying a workspace identifier and, where a person caused it, that person's account identifier; workspace attributes limited to plan, seat and connection counts and dates; and error reports carrying an error type, a stack trace and bounded diagnostic tags, keyed to the server process rather than to a person and grouped by the identifier of the workspace the error occurred in. These include failures of product pages in a person's browser, which our servers relay as only the error's class, the kind of page and its reference number — never what the page showed or who was looking at it. From a consenting visitor's browser on our public pages only: pages viewed, elements clicked, page performance and browser errors, sent by way of our own domain; inside the product, only that visitor's account and workspace identifiers. No source content, questions, names or email addresses | European Union |
| HubSpot, Inc. | Demo bookings and our contact records for people who ask to talk to us | First name, last name, work email, chosen meeting time and time zone, and our correspondence | Australia (HubSpot's AP1 data region) |
| Resend (Plus Five Five, Inc.) | Delivers account and service emails: workspace invitations and a reminder three days later, sign-in links, password resets, billing notices, a welcome to a new workspace, notices that someone joined, that a person's access ended or that an AI agent was connected or disconnected, a warning to a workspace's administrators when a connection has been failing for a day, and onboarding tips (which a person can turn off) | Recipient email address, the inviting person's name, the workspace name, and the link in the message; for an AI agent, its product family (for example Claude); for a failing connection, the kind of connection (for example Gmail). Never the content of a source | United States (account data, delivery logs and message metadata); messages are sent from the European Union (Ireland) |
Data retention by model providers
We send model providers only the text a task needs, and a picture only to transcribe the text in it. We do not use Customer Data to train AI models. Whether a model provider or gateway retains request data, and for how long, is governed by its terms with us. We are enabling routing that requires zero data retention wherever a provider supports it; this page will say so, provider by provider, once it applies.
Changes to this list
We will update this page at least 30 days before a new subprocessor begins processing Customer Data, except where a change is needed urgently to keep the Service running or secure, in which case we will update it as soon as we can. Customers can object as described in the DPA.
To be told about changes by email, write to legal@louvain.ai with the subject "Subprocessor updates".
Questions about this document: legal@louvain.ai.