Sub-processors

• OpenRouter, to route the Service's language-model requests, including transcription, image generation and embeddings, and the model providers those requests reach. Receives prompts, retrieved memory and documents, tool results, attached audio, and image prompts.
• Google, whose Gemini embedding model (gemini-embedding-2) turns memory and documents into search vectors. By default it is reached through OpenRouter; the Service can instead be configured to call the Gemini API directly. Either way it receives the text being indexed and every question asked of it.
• E2B and Amazon Bedrock AgentCore, which run the agent's code in a sandbox created for each workspace. Receive the files the agent reads or writes, including uploads.
• Composio, to hold the authorizations for the apps you connect and to call them on your behalf. Receives the connected account's identifier and whatever the called tool returns.
• treg, the data-API catalogue the agent queries for company research. Receives the queries the agent sends: company names, domains, and people's names.
• Kalodata, when it is switched on, for TikTok Shop sales data the agent queries. Receives the query conditions the agent sends, such as the market, category, filters and the creator, shop or product ids.
• Slack, when Ara is installed there. Receives the messages in the channels Ara is in, and member profiles.
• Resend, to deliver transactional email such as sign-in links. Receives the email address.
• Creem, to take payment for credit packs. Receives the billing email and what was bought; card details never reach the Service.
• PostHog, for product analytics and error reporting, analytics only with your consent. Receives account identifiers, event counts, and the errors our own code threw with their messages.
• GitHub, to keep the agent's reports of problems with the Service as issues in our repository. Receives what the agent wrote about the problem and the run and workspace identifiers; it is told to leave your content out.
• Our cloud hosting provider, for the servers and the database. Receives everything the Service processes.
• Cloudflare, which fronts the Service's traffic. Receives requests in transit.

When we add or replace a sub-processor we update this page and the date at the top. If a change materially reduces your rights or changes how we use your data, we tell you in the dashboard or by email before it takes effect, as the privacy policy describes.