Subprocessor List
- Current operator:
- Retractability Bicycles LLC
- Principal location:
- Glendale, Arizona, United States
- Contact:
- support@splittai.app
- Effective date:
- October 22, 2026
- Last updated:
- October 22, 2026
The following is the founder-declared public-launch stack for Splitt, operated by Retractability Bicycles LLC. Declaration is not independent verification of hosted settings. The remaining uncertainties are disclosed below; this interim publication does not resolve them. No inactive or unconfirmed integration is represented as active.
| Service | Purpose and data | Launch declaration | Verification still required |
|---|---|---|---|
| Supabase | Authentication, database and private storage; account, workspace records and uploaded content | Founder-confirmed active; project region West US (Oregon) | Other processing/backup regions, DPA, backups, logs, deletion and contractual retention |
| Vercel | Application hosting and delivery; requests and operational metadata | Founder-confirmed active | Exact production compute/logging/data regions, redaction, retention and contracts |
| OpenAI API | Authorized AI requests, bounded context and outputs; OCR available where enabled | Founder-confirmed active; no intentional training-data sharing opt-in | Exact retention tier, ZDR, regions and DPA; hosted OCR availability |
| Resend | Transactional email and shared support inbox; headers, addresses, subjects, bodies, replies, metadata and attachments | Founder-confirmed active outbound; inbound receipt tested; no inbound webhook or automated AI triage/response | Attachment/reply handling, authorized access, retention, deletion and processing regions |
| Vercel Web Analytics | Optional, permission-gated marketing measurements; provider describes anonymous, cookie-free analytics and a visitor hash discarded after approximately 24 hours | Founder-confirmed enabled; legal routes excluded | Aggregate retention, processing regions and hosted consent/route acceptance; visitor-hash expiry is not aggregate deletion |
| Splitt first-party product analytics | Allowlisted content-free events, coarse interactions and aggregates; no prompts, responses, documents, form values or raw clicked text | Founder-confirmed enabled; operated by Splitt, not a separate third-party subprocessor | Execution of the 14-day interaction, 90-day identified-event and 365-day aggregate pruning thresholds; privacy controls |
Unconfirmed or inactive capabilities
OCR is founder-confirmed enabled but remains subject to hosted processing verification; public wording is “available where enabled.” Google OAuth/Workspace and TypeSafe/Jev are treated as inactive for publication, not active launch providers. Production processing for these integrations has not been verified, and this list does not represent them as active. If TypeSafe/Jev shadow sampling sends real requests, it is provider processing and requires disclosure even though it is non-authoritative. Stripe paid billing and general public web research are not active launch capabilities. No new provider is enabled by this document.
Changes and contact
Changes in providers or processing must be reviewed and reflected in the policies and required notices before the changed processing begins. Questions: support@splittai.app, subject “Splitt Privacy Request — Subprocessors.” The shared inbox is intended for human review; no AI triage, webhook or reply automation is introduced by this release. Actual inbox handling still requires verification.
Splitt is a product operated by Retractability Bicycles LLC.
Contact support@splittai.app. For privacy requests, use the subject “Splitt Privacy Request”. Do not send passwords or authentication tokens.