Subprocessors
Last updated: 13 October 2026
These are the types of third parties that may process personal data for GenFleet (Genfleet LLC (in formation), Nasr City, Cairo, Egypt). This page forms Annex 3 of our Data Processing Agreement.
Named list. Business customers can get the current list of subprocessors, with company names and locations, by emailing privacy@genfleet.ai. We send it under the confidentiality terms of our agreement with them.
Changes. We will give at least 30 days' notice before adding or replacing a subprocessor that processes customer data, by email to account owners. The notice names the new subprocessor, says what it will do and where, and explains how to object (DPA section 6).
1. Infrastructure
| Type of provider | What it does | Data | Location |
|---|---|---|---|
| Cloud hosting provider | Hosts the GenFleet platform: application, agent sandboxes, database, file storage | All platform data | Outside Egypt |
| Network edge and domain name service | Delivers our website and protects it from attacks | Website visitors' IP addresses and request details | Global network; company based in the USA |
Our database, file storage, and logging and monitoring tools run on servers we operate ourselves. No third party operates them.
2. AI model providers
Agents send prompts (the business's instructions, conversation history, the end customer's message, and tool results) to an AI model to write replies. We also use these providers for agent memory features, such as summarising conversations and making saved information searchable.
A model can be reached in two ways:
- Through GenFleet's AI gateway, using GenFleet's own account with the provider. The provider is then our subprocessor, on the terms below.
- With the business's own provider key. If a business adds its own key for a provider, that provider acts under the business's own agreement with it, not as our subprocessor.
| Type of provider | What it does | Data terms | Location |
|---|---|---|---|
| Model router | Routes model calls from our AI gateway to the companies that host the models | We allow only model hosts that do not collect data and keep no copy of it (zero data retention), from a fixed list we approve, with no fallback outside that list | USA |
| AI model providers | Run the AI models that write agents' replies and support memory features | None of them may use the data to train models. Depending on the provider, copies are deleted straight after the request or kept for up to 30 days for abuse monitoring, and longer only if a request is flagged for breaking the provider's usage policy. We do not use free tiers that may use data to improve the provider's products | USA and Egypt. A provider in Egypt may pass requests to model providers in other countries and keeps its backups in Germany |
3. Communication
| Type of provider | What it does | Data | Location |
|---|---|---|---|
| Email provider | Sends account emails (invitations, password resets, security notices) and hosts our company inbox, including messages you send us and website form submissions | Name, email address, email content | USA |
| Form-handling service | Forwards demo-request and waitlist forms from our website to our inbox | Email, role, GitHub username, form answers | Outside Egypt |
4. Services a business chooses to connect
These are not our subprocessors in the usual sense. The business decides to connect them, has its own account or relationship with them, and data flows to them because it asked. We list them so you know where data goes.
Messaging channels
- Meta Platforms (WhatsApp Business Platform, Messenger, Instagram).
- Telegram.
- Slack.
- Discord.
Tool connectors
- GitHub, Atlassian (Jira), Linear, ClickUp, Asana, Notion.
AI model providers used with the business's own key
- Any model provider the business adds its own key for.
Websites and services an agent contacts
- Any website or API the business allows its agent to contact.
5. Other providers that do not receive customer data
- Web font service (USA): the GenFleet app loads fonts from it, so it receives users' IP addresses and browser details. Our website serves its own fonts.
- Certificate authority (USA): issues the certificates that secure our connections.
- Code hosting (USA): hosts our source code and build tooling. It holds no customer data.