What this list covers
A sub-processor is a third party that Reline engages to process personal data on its behalf in order to run the service. Every vendor below receives only the data required for its function, under a written data processing agreement, and is bound by obligations no less protective than our Data Processing Addendum.
Integrations you connect yourself (Slack, Notion, Linear, Zapier, outbound webhooks and MCP clients) are not sub-processors: they receive data because you, or an admin in your workspace, instructed Reline to send it. They are described in the privacy policy.
Current sub-processors
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Convex | Primary database, authentication and realtime sync. Stores account data, calendar metadata, notes, transcripts and summaries, encrypted at rest. | USA | EU SCCs (2021/914) + UK Addendum |
| Cloudflare (R2) | Object storage for audio recordings, uploaded files and complete data-export bundles. | USA | EU SCCs (2021/914) + UK Addendum |
| Speech-to-text provider | Real-time transcription. Audio is streamed during a recording session using a temporary, session-scoped key. Named in the DPA annex on request. | USA | EU SCCs (2021/914) + UK Addendum |
| Vercel | Hosting of the web application; the AI Gateway through which every language-model request is routed; cookieless Web Analytics and Speed Insights. | USA | EU SCCs (2021/914) + UK Addendum |
| OpenAI | Embeddings of notes, transcripts and summaries (search and chat); meeting-prep intelligence, which includes attendee email addresses from your calendar; chat titles and some generations. | USA | EU SCCs (2021/914) + UK Addendum |
| Baseten | Inference hosting for the Z.ai GLM language model used for summaries, chat answers and other generations, reached through the Vercel AI Gateway. | USA | EU SCCs (2021/914) + UK Addendum |
| DeepInfra | Inference hosting for the Z.ai GLM language model used for summaries, chat answers and other generations, reached through the Vercel AI Gateway. | USA | EU SCCs (2021/914) + UK Addendum |
| WorkOS | Enterprise SSO and directory sign-in, only where your organisation enables it. | USA | EU SCCs (2021/914) + UK Addendum |
| Lemon Squeezy (a Stripe company) | Merchant of record and payment processing. Receives billing details to process payments. | USA | EU SCCs (2021/914) + UK Addendum |
| Resend | Transactional and product email delivery (sign-in links, invitations, recaps, onboarding tips). | USA | EU SCCs (2021/914) + UK Addendum |
| PostHog | Product analytics and session replay, only after you consent to analytics. | USA | EU SCCs (2021/914) + UK Addendum |
All sub-processors are located in the United States. Transfers of personal data from the EEA, the UK and Switzerland rely on the EU Standard Contractual Clauses (Decision 2021/914, Module Three) together with the UK International Data Transfer Addendum and the Swiss adaptations, plus supplementary measures where required. Where a sub-processor is certified under the EU-U.S. Data Privacy Framework, that mechanism may also apply.
Language-model providers process content only to return the result you asked for. Under their API terms they do not use it to train models, and retention is limited to what each provider's policy specifies (for example a short abuse-monitoring window).
The speech-to-text provider is not named on this page. It is identified, with its full legal name and address, in the sub-processor annex we provide with the DPA. Email legal@reline.so to request it.
How we notify you of changes
Before adding or replacing a sub-processor, we update this page and email the owners of every workspace at least 30 days in advance. Customers under the DPA may object on reasonable data-protection grounds within that period, as described in Section 7 of the DPA.
Removing a sub-processor, or narrowing what it receives, is recorded in the change log below without a notice period.
Change log
- September 2, 2026 — First published list. Corrections versus the previous privacy policy: Anthropic removed (Reline makes no calls to it); Baseten and DeepInfra added as the inference hosts that serve the Z.ai GLM model; Vercel’s role extended to the AI Gateway, Web Analytics and Speed Insights; PostHog location corrected to USA; OpenAI’s role clarified (embeddings, meeting-prep intelligence, chat titles and some generations).
أسئلة؟ بريد إلى legal@reline.so.