Legal

Sub-processors

Every company that touches anything of yours on the way through Converside, what each one gets, where it sits, and how long it keeps it. Four names, complete.

Underneath the table we also publish what reaches none of them, which is most of what Converside touches.

converside.com/sub-processorsVersion 1.0Effective 1 October 2026

Why this page names names

We do not name the model, or the company that makes it, anywhere else on this site or in the app. The model is our choice and our cost, and it changes without notice; a product that advertises a vendor is selling you something it does not control.

This page is the exception, and it is not a marketing decision. If you are in the EU or the UK, Article 28 of the GDPR gives you the right to know who processes your data. In California the CCPA does. If you are buying for a company, your counsel will ask in writing. So here they are, named.

Sub-processor	What it receives	Where	What it keeps
OpenAI, L.L.C.Generating the suggested reply	The recognised text of one question, the last three turns of the conversation before it, the About-you note you wrote, the reply language you chose, and the reply it writes — for the length of that one request. Never audio, never your email address, never the rest of the transcript.	United States	No copy of the reply is stored as an application record. Under its standard API data controls, abuse-monitoring logs of a request — which may contain the question, the three turns, your note and the reply — are kept for up to 30 days and then deleted. Its API terms state that data submitted through the API is not used to train its models.
OVHcloudThe machine our server and the account database run on	Every request between the app and us, and the IP address it came from. Our server runs on a machine we rent from it, so the question, the last three turns and your note pass through that machine for the seconds a reply takes. The database on the same machine holds the account record: email address, plan, payment reference, the count of replies this period, your signed-in devices, and the UTC offset that sets your midnight.	Singapore, for requests and for the account record.	The account record, until you delete your account from inside the app; then everything else in it goes, and only the payment reference that finds your invoices (the Stripe customer and subscription references) and the period totals stay. Our server keeps no request log and writes no request body anywhere, so no question and no reply is written to storage on this machine. Its own network security logs follow its published retention policy.
Stripe, Inc.Payment and subscription records	Your email address, your billing address, and the card details you type into Stripe’s own fields. Those fields belong to Stripe; the numbers never reach our server.	United States	Your customer record, payment method and invoices, for as long as its own terms and US tax law require. Invoices outlive the deletion of your Converside account because the law says they must.
FunFirst s.r.o. (Emailit)Delivering the sign-in email	Your email address, and the single-use sign-in link or six-digit code being sent to it.	Czech Republic (EU)	Delivery metadata, under its own published retention policy. We do not read it.

What each company receives and keeps is read from that company’s own terms and data-processing documentation as they stood on 1 October 2026. We read all four again whenever this list changes, and the effective date above moves when we do.

Not on the list, because nothing reaches them

Your microphone. The permission is not declared in the app, so macOS cannot prompt for it or grant it. You can check that yourself in System Settings.
The audio of the call. No code path writes it to disk, a test enforces that, and none of it is sent anywhere.
The rest of the transcript. Transcription runs on your machine. When a reply is generated, the question and the last three turns before it travel as text; the rest of the transcript never leaves this Mac.
Anything on your screen. macOS exposes system audio through the Screen Recording permission. Nothing on screen is captured, read or transmitted.

Before this list changes

We email every account at least thirty days before we add, replace or remove anyone on this list, and we say who, what they will receive, and why. The notice is not buried in a product update, and the version and date above change with it.

If you do not accept a change, you can cancel and stop using Converside inside that window, before anything reaches the new company. That right is written into the terms, in section 6, so it is not ours to withdraw later.

For buyers and data teams

The controller is Bytek LLC, 1111B S Governors Ave STE 28322, Dover, DE 19904, United States. We will sign a data processing agreement with you, including the EU standard contractual clauses and the UK addendum. Write to contact@converside.com.

Transfers out of the EEA and the UK to the companies above rely on the transfer mechanism set out in each of their own data-processing terms. We will tell you which one each company uses, in writing, if you ask.