Sub-processors
Last updated: 4th August 2026 Controller: Nimble Technology Group Ltd
These are the third parties that process personal data on our behalf in order to run Agnis. We publish this list because you should be able to see where your data goes before you put anything into the product.
Infrastructure — always involved
| Sub-processor | Function | Data processed | Location | Transfer basis |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage | Account data, all your context, chats, documents, uploaded files | EU — Ireland (eu-west-1) and Germany (eu-central-1) | Storage in the EEA, covered by UK↔EEA adequacy. Administrative access by the US-based entity is covered by the EU Standard Contractual Clauses and the UK Addendum, both incorporated in Supabase's DPA |
| Vercel Inc. | Application hosting, edge network, serverless functions, document conversion | Requests, IP addresses, technical logs; file content transiently during conversion | US-headquartered; edge and function regions: London, United Kingdom | Processing in the UK. Administrative access by the US-based entity is covered by the UK Extension to the EU–US Data Privacy Framework, if Vercel's certification includes it, and in any event by the EU SCCs and the UK IDTA/Addendum in Vercel's DPA, which their terms state prevail |
| Resend | Transactional email, sign-up confirmation, password reset | Email address, name, message content | Ireland (eu-west-1) | Storage in the EEA, covered by UK↔EEA adequacy |
AI model providers — only when you select them
These are engaged by your choice of model. If you never select a provider's models, nothing goes to it. If you leave model selection on Auto, Agnis chooses for you and may engage any of them.
| Sub-processor | Models | Data processed | Location | Notes |
|---|---|---|---|---|
| Anthropic PBC | Claude | Your message plus the context you have chosen to send | United States | API data not used for model training under their commercial terms |
| OpenAI, L.L.C. | GPT | As above | United States | API data not used for model training under their API terms |
| Google LLC | Gemini | As above | United States | Paid API data not used for model training under their terms |
| Moonshot AI | Kimi | As above | People's Republic of China | Your own API key only. Never platform-funded. See below |
For the US providers, transfers rely on the UK Extension to the EU–US Data Privacy Framework where the provider participates, and otherwise on the UK IDTA or UK Addendum with a transfer risk assessment. For each provider, API data is not used to train their models under the API terms in force. We rely on those terms; we cannot guarantee their conduct.
Automatic model selection. If you leave model choice on Auto, Agnis picks a model for you, which means it picks the provider. Auto only ever chooses from models you can actually run, so it can select Kimi only if you have added your own Moonshot key. If you have added one and you need certainty about the destination for a particular piece of work, choose the model yourself instead of using Auto.
Moonshot AI (Kimi) — bring your own key only
Kimi models cannot be used on Agnis-funded capacity. They are available only if you add your own Moonshot API key.
Why
Moonshot AI processes requests in the People's Republic of China. There is no UK adequacy regulation for China, so a transfer of personal data there is a restricted transfer under UK GDPR and requires an appropriate safeguard under Article 46, in practice the ICO's International Data Transfer Agreement or the UK Addendum to the EU SCCs, together with a transfer risk assessment concluding that the protection those clauses provide is not undermined in practice at the destination.
We are not willing to make that transfer on your behalf and on our own judgement. So we do not.
What this means for you
- If you never add a Moonshot key, no data of yours ever reaches Moonshot. Kimi models are not selectable, and Auto will not pick them.
- If you do add a Moonshot key, requests run against your Moonshot account under your contract with Moonshot. On that traffic you are the data exporter, not us, and the decision, including whether you need your own safeguards and transfer risk assessment, is yours to make and document.
- Agnis warns you about this at the point you add a Moonshot key, and again on the Kimi models in the model selector. Adding the key is your acknowledgement of it.
Our role
For Kimi traffic we transmit your request to the endpoint your key authenticates against. We do not hold a contract with Moonshot, we do not fund the usage, and we do not decide that the transfer should happen, you do, by adding the key and selecting the model.
Browser-provided processing (not a sub-processor of ours)
| Service | When | Note |
|---|---|---|
| Your browser's speech recognition | Only if you use the microphone | Dictation uses the Web Speech API. In some browsers — Chrome notably — audio is transcribed on the browser vendor's servers. We never receive audio, and this processing is governed by your browser vendor's privacy policy, not ours. Disclosed for transparency |
Changes to this list
We will publish changes here before a new sub-processor begins processing. Business customers who have asked to be notified will get 30 days' notice by email, and may object.
Subscribe to notifications: privacy@agnis.io
If any of these are added, this list is updated first.