Subprocessors

These are the providers that receive data so TerminalSync can work, with each one's purpose, where data is processed and what safeguards apply when it leaves the European Economic Area.

Draft version: 2026-10-16

1. List of providers

TerminalSync uses an included AI assistant powered by the GLM model from Z.ai (Zhipu AI), a company of Chinese origin. We name it plainly here because, when you use that AI, your message and the Context material needed leave the European Economic Area.

Z.ai (Zhipu AI)

Purpose: Generates the answers of TerminalSync's included AI.
Data: Your message, the active material in the Context panel, the previous conversation in that workspace and the memory needed to answer.
Location: Chinese-origin provider (Zhipu AI) with an international entity in Singapore. The exact processing region is not on record.
Transfer outside the EEA: [A CONFIRMAR POR ABOGADO: international transfer mechanism (adequacy decision, standard contractual clauses or other), existence of a processor agreement (GDPR art. 28) and whether the transfer is viable; processing region; provider retention and training use]
Source: per the current Privacy Policy

Cloudflare

Purpose: Intermediate server (Worker) the AI request travels through to Z.ai; checks that your plan is current and counts usage. Also DNS and network for the site.
Data: Request content in transit (not stored). For usage we record an account identifier, the model, input and output size and cost, never the text.
Location: Not on record.
Transfer outside the EEA: [A CONFIRMAR POR ABOGADO: processing location and transfer mechanism (EU-US Data Privacy Framework certification or standard clauses)]
Source: per the current Privacy Policy

Stripe

Purpose: Payment of subscriptions and prepaid credits; invoicing.
Data: Email, billing details, plan status and amounts. Card data is collected directly by Stripe; TerminalSync only sees the last four digits.
Location: United States (current policy).
Transfer outside the EEA: [A CONFIRMAR POR ABOGADO: Stripe entity that contracts with EU customers, location and transfer mechanism]
Source: verified in the web code

Supabase

Purpose: Account database and authentication.
Data: Email, name and avatar (if you provide them), time zone, subscription, sign-in logs, support tickets and conversations.
Location: EU or US (current policy).
Transfer outside the EEA: [A CONFIRMAR POR ABOGADO: exact project region and transfer mechanism if outside the EEA]
Source: verified in the web code

Vercel

Purpose: Hosting of the website and API. With your analytics consent, also Vercel Web Analytics and Speed Insights.
Data: Technical connection data (for example IP and browser) in server logs; with consent, pages visited, click events and performance metrics.
Location: Global edge network; US.
Transfer outside the EEA: [A CONFIRMAR POR ABOGADO: transfer mechanism and whether Vercel analytics can be considered exempt from consent]
When: Only with your analytics consent
Source: verified in the web code

Sentry

Purpose: Error detection for the site. In the browser it is initialised only with your analytics consent; on the server it records technical errors.
Data: Error message and stack trace, URL, browser and system. No session replay.
Location: Not on record.
Transfer outside the EEA: [A CONFIRMAR POR ABOGADO: Sentry data region (EU or US), transfer mechanism and whether server-side error logging can be considered necessary]
When: Only with your analytics consent
Source: verified in the web code

Resend

Purpose: Sending of transactional emails.
Data: Email address and message content.
Location: United States (current policy).
Transfer outside the EEA: [A CONFIRMAR POR ABOGADO: transfer mechanism]
Source: verified in the web code

Rewardful

Purpose: Affiliate programme attribution. Loaded only if you accept the “Affiliates” category.
Data: Identifier of the referring affiliate (60-day cookie) and technical visit data.
Location: Not on record.
Transfer outside the EEA: [A CONFIRMAR POR ABOGADO: location and transfer mechanism]
When: Only with your affiliates consent
Source: verified in the web code

n8n (servidor gestionado por TerminalSync)

Purpose: Automation of the support chat, the welcome email and the notifications you choose to receive.
Data: Messages you write to the support chat, your email when you ask us to contact you and the content of the notifications you choose.
Location: Not on record.
Transfer outside the EEA: [A CONFIRMAR POR ABOGADO: hosting provider and server country]
Source: per the current Privacy Policy

SearchApi

Purpose: Public searches (businesses and reviews on Google Maps, YouTube videos) when you ask the AI to do so.
Data: Search text or video link, country and language. It does not receive your name, email or documents.
Location: United States (current policy).
Transfer outside the EEA: [A CONFIRMAR POR ABOGADO: transfer mechanism]
When: Only when you ask for it
Source: per the current Privacy Policy

Google

Purpose: Site typefaces (Google Fonts), sign-in with Google if you choose it and the Drive file picker from the app.
Data: IP address and technical request data when loading the fonts; your Google account data if you sign in with it.
Location: United States and global network.
Transfer outside the EEA: [A CONFIRMAR POR ABOGADO: transfer mechanism; fonts load before consent, so decide whether to self-host them (handoff task W2)]
Source: verified in the web code

unpkg (CDN de librerías)

Purpose: Delivers the icon library on the home page.
Data: IP address and technical request data.
Location: Not on record.
Transfer outside the EEA: [A CONFIRMAR POR ABOGADO: loads before consent; the library should be self-hosted (handoff task W2) and this row removed]
Source: verified in the web code

Google (imágenes), WaveSpeed e Ideogram

Purpose: Image generation from the desktop app.
Data: The image request text and any reference images you attach.
Location: Not on record.
Transfer outside the EEA: [A CONFIRMAR POR ABOGADO: this row comes from the desktop app documentation and cannot be verified from the web code; confirm actual providers, location, transfer mechanism and prior consent]
When: Only when you ask for it
Source: app documentation; not verifiable from the web

2. Who is not listed here

Services you connect with your own credentials (your Google Drive or iCloud, or third-party accounts you link as connectors) are not listed: there you decide what is shared and with whom.

3. Changes to this list

We will update this page when a provider is added or replaced. [A CONFIRMAR POR ABOGADO: prior-notice period (days), how to notify business customers and right to object or terminate]

4. Questions

Write to us at privacy@terminalsync.ai.