Sub-processors
Every company that handles your data for SozAI, with what it receives and which of your actions sends it there.
Last updated: 2026-10-25.
A sub-processor is a company that handles your data so that SozAI can work: it stores a file, recognizes speech, runs an AI model or sends an email. This page lists every one of them for the SozAI apps (iPhone, iPad, Mac, Android), the web app at web.sozai.app and the Chrome extensions, then for the sozai.app website. For each, you see what it receives and which action of yours sends it there.
Two things to read first. Our storage is in Germany, but speech recognition runs in the United States, so the audio of each uploaded file or recording goes there once. And the AI model behind a task can change without an app update; when the list of model providers changes, this page changes.
The apps and extensions
| Provider | What it processes | When | Location or endpoint | Its privacy or security page |
|---|---|---|---|---|
| Hetzner Online | Everything we store: the database (accounts, transcripts, notes, flashcards, quizzes) and the audio files | Always | Germany: Nuremberg (app backend), Falkenstein (sozai.app website) | Privacy policy ISO/IEC 27001 certificate |
| Cloudflare | All web traffic to our domains passes through it (CDN, TLS). It also stores our encrypted nightly database backups (R2) and forwards mail sent to [email protected] | Always | Global network; backup bucket in Cloudflare R2 | Privacy policy Trust Hub |
| AssemblyAI | The audio of the file or recording. It returns the text with speakers and timestamps | You upload a file or record in the app or the web app, or use the WhatsApp or Transcribe Audio to Text extension | United States (api.assemblyai.com) | Privacy policy Security |
| Google (Gemini API) | The YouTube link and our instructions. No audio from you | You paste a YouTube link into the app or the web app | Google's global API endpoint (generativelanguage.googleapis.com) | Gemini API terms Google Privacy Policy |
| OpenRouter | Transcript text and chat messages, plus the PDF pages or photos you add as a source. It passes each request to a model provider below | You ask for a summary, notes, flashcards, a quiz, a title, a translation of a transcript or a chat answer | OpenRouter, Inc., servers in the United States (openrouter.ai) | Privacy policy Provider logging |
| Anthropic (models, via OpenRouter) | The same text as above, for the tasks assigned to its model | Chat with a recording, summaries, titles, transcript translation, flashcards | Host chosen by OpenRouter per request | Privacy policy |
| Google (models, via OpenRouter) | The same text, plus PDF pages and photos to read | Structured notes and quizzes; reading PDF pages and photos; sorting a recording by type | Host chosen by OpenRouter per request | Google Privacy Policy |
| xAI (models, via OpenRouter) | The same text, for the tasks assigned to its model | Some assistant features | Host chosen by OpenRouter per request | Privacy policy |
| DeepSeek (model, via OpenRouter) | The same text | Only when the main model for a task fails | Host chosen by OpenRouter per request | Privacy policy |
| Apple and Google speech recognition | The audio you dictate. The translation itself runs on your device | You dictate into a note or use Voice Translate in the phone app | Your phone's system speech service (Apple on iPhone and iPad, Google on Android) | Apple: dictation and privacy Google Privacy Policy |
| Google and Apple sign-in | The name and email of that account, used to open your SozAI account | You choose Sign in with Google or Sign in with Apple | Google, Apple | Google Privacy Policy Sign in with Apple and privacy |
| Apple App Store and Google Play | Payment and subscription | You subscribe to Premium | Apple, Google | Apple Privacy Policy Google Privacy Policy |
| RevenueCat | Your app user ID and email, with your store receipts and subscription status | You open the app and when you subscribe | United States (api.revenuecat.com) | Privacy policy Data processing addendum |
| Google Firebase | The device token and the text of each push notification; app usage events (Firebase Analytics) | The SozAI apps | Firebase privacy | |
| Meta (Facebook App Events) | App events: install, launch, purchase, trial start, onboarding finished. Ad tracking follows your answer to Apple's tracking prompt | The iPhone and Android app | Meta Platforms | Meta Privacy Policy |
| Apple Ads attribution | An attribution token that tells us whether the install came from an Apple ad | The iPhone and iPad app, after install | Apple (api-adservices.apple.com) | Apple advertising and privacy |
| Telegram | Your support message and email, plus the app version and an excerpt of the recording you write about | You send a message to support from inside the app | api.telegram.org | Privacy policy |
| Google (Gmail) | Email you send to [email protected], after Cloudflare forwards it | You email support | Google Privacy Policy |
The web app at web.sozai.app talks only to our own API. The Chrome extensions talk only to sozai.app and our API, and carry no analytics code.
The sozai.app website and its free tools
The free tools work without an account and keep their results in your browser. They use different partners from the app, and the AI behind them runs on free models. Don't paste confidential text into them.
| Provider | What it processes | When | Location or endpoint | Its privacy or security page |
|---|---|---|---|---|
| YouTube Data API and oEmbed (Google) | The video ID. It returns the video's title and channel | Same as above | YouTube API terms Google Privacy Policy | |
| OpenRouter (free models) | The text you paste, or the text of the YouTube video or PDF you choose. Also the public YouTube transcripts we summarize for the transcript library | You use the quiz or flashcard tools or a summarizer; the library is processed in the background | OpenRouter, Inc., United States; the free models are served by providers that may log or use what they receive | Privacy policy Provider logging |
| AssemblyAI | The first five minutes of the audio you choose. We delete the job after processing | You transcribe a file with a free tool on sozai.app/tools/ | United States | Privacy policy |
| Cloudflare Turnstile | Browser signals for a bot check | You submit a form on the website | Cloudflare | Turnstile privacy |
| Google Analytics 4 | Page visits and clicks, loaded after your first interaction or a few seconds | You browse sozai.app | How Google uses data |
Services you connect yourself
If you connect SozAI to ChatGPT, OpenAI receives the transcripts and notes the assistant asks for on your behalf; with Claude, Anthropic does. They are recipients you choose, not processors we use, and they handle that data under your agreement with them. The privacy policy describes what the connection shares.
How we announce changes
When a sub-processor is added or replaced, or what one receives changes, we update this table and the date at the top, and note the change in the changelog. If your organization needs to hear about changes before they happen, write to [email protected] and we'll email you when the list changes.
How we store and delete data, and what we don't offer yet (HIPAA, a SOC 2 report, single sign-on), is on the security page.
Answers
Frequently asked questions
Which sub-processors receive the audio of my recordings?
Hetzner stores it on our servers in Germany, and AssemblyAI receives it for speech recognition at its US endpoint. Cloudflare carries it on the way, as it carries all traffic to our domains. No AI model provider receives your audio: the AI features work from the transcript text. Audio you dictate into a note goes to your phone's own speech service, Apple's or Google's.
Why are several AI companies listed?
Different tasks use different models. Summaries and chat go to one model. Structured notes and quizzes go to another, and a third handles some assistant features. All of them are reached through OpenRouter, which passes each request to a provider that serves the model. If the main model for a task fails, a fallback model answers instead, so its provider is listed too.
Does any sub-processor train AI models on my recordings?
Our own code never sends your recordings into model training. Each partner handles data under its own terms, and those terms differ, so we link every partner's privacy page in the table rather than speak for them. The free tools on sozai.app use free models whose providers may log or use the text they receive; don't paste confidential material there.
Is my data processed outside the EU?
Yes. Storage is in Germany, but speech recognition runs in the United States. OpenRouter is a US company too, as are the model providers behind it. Billing goes through Apple or Google, RevenueCat is in the US, and the support inbox runs on Telegram and Gmail. The table shows the location or the endpoint of each partner where we know it.
How will I know when this list changes?
We update this page and the date at the top whenever a partner is added or replaced, or what it receives changes, and we note the change in the changelog. Organizations that want an email before a change takes effect can write to [email protected] and ask to be added to the notice list.