Floot

Sub-processors

Floot, Inc. uses the sub-processors below to provide the Floot platform and the applications hosted on it. This list is Appendix C of Floot's Data Processing Addendum (DPA).

In this list, Data means the personal data Floot processes for customers under the DPA, and End-User Data means data that applications built on Floot handle about their own users.

Customers who have accepted Floot's DPA are emailed before a new sub-processor starts handling their Data, as the DPA sets out. Services that customers connect to their own applications with their own accounts or API keys are the customer's own providers and are not listed here.

Questions: privacyinfo@floot.com

Amazon Web Services, Inc.

  • What it does: Hosting for the Floot platform and every hosted application: serverless compute, object storage (including project code and builder chat history), email delivery (SES), content delivery (CDN), logs, push notification configuration. All Data stored or served by hosted applications.
  • Location of processing: United States (us-east-1); CDN edge caches worldwide
  • Retention: Term of the Agreement. Logs: 90 days.
  • Address: 410 Terry Avenue North, Seattle, WA 98109-5210, USA
  • Contact: DPO: aws-EU-privacy@amazon.com
  • DPA: AWS DPA

Render Services, Inc.

  • What it does: Managed PostgreSQL for the Floot platform database: account data, project records and settings, email and push notification records.
  • Location of processing: United States
  • Retention: Term of the Agreement.
  • Address: 525 Brannan St, San Francisco, CA 94131, USA
  • Contact: privacy@render.com
  • DPA: Render DPA

Databricks, Inc., with its affiliate Neon, LLC

  • What it does: Managed PostgreSQL for each customer application's own database (End-User Data).
  • Location of processing: United States (AWS us-east-1)
  • Retention: Term of the Agreement; deleted with the application.
  • Address: 160 Spear Street, 15th Floor, San Francisco, CA 94105, USA
  • Contact: privacy@databricks.com
  • DPA: Databricks DPA

Tinybird, Inc.

  • What it does: Visitor analytics for published applications: page path, referrer host, browser, language, country derived from time zone, random session identifier. No IP addresses.
  • Location of processing: United States (AWS us-east)
  • Retention: Raw events 12 months; deleted with the application.
  • Address: 41 East 11th Street, 11th Floor, New York, NY 10003, USA
  • Contact: legal@tinybird.co
  • DPA: Tinybird DPA

Anthropic, PBC

  • What it does: AI model inference (Claude), through the Anthropic API and Claude Platform on AWS (operated by Anthropic). Builder prompts, project files and chat; End-User Data when a hosted application uses AI features. No training on customer content.
  • AI feature: Floot AI builder; AI features in hosted applications.
  • Location of processing: United States; inference region not pinned
  • Retention: Inputs and outputs deleted within 30 days.
  • Address: 548 Market St, PMB 90375, San Francisco, CA 94104, USA
  • Contact: privacy@anthropic.com; DPO: dpo@anthropic.com
  • DPA: Anthropic DPA

OpenAI OpCo, LLC

  • What it does: AI model inference, image generation and web search. Builder prompts, project files and chat; End-User Data when a hosted application uses AI features. Requests sent with storage disabled. No training on customer content.
  • AI feature: Floot AI builder; AI features in hosted applications.
  • Location of processing: Not pinned to a region
  • Retention: Abuse-monitoring logs up to 30 days.
  • Address: 1455 3rd Street, San Francisco, CA 94158, USA
  • Contact: privacy@openai.com
  • DPA: OpenAI DPA

Google LLC

  • What it does: AI model inference and image generation (Gemini API, paid tier; Vertex AI, global endpoint): builder prompts, project files and chat; End-User Data when a hosted application uses AI features. Firebase Cloud Messaging: delivery of native push notifications. No training on customer content.
  • AI feature: Floot AI builder; AI features in hosted applications. Push notifications.
  • Location of processing: Global
  • Retention: Gemini API: abuse-monitoring logs up to 55 days. Vertex AI: per Google Cloud terms. Firebase Cloud Messaging: until delivered, at most 28 days.
  • Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
  • Contact: Through the DPA links
  • DPA: Gemini API, Vertex AI, Firebase

Fireworks.ai, Inc.

  • What it does: AI model inference (open-weight models). Builder prompts; End-User Data when a hosted application uses AI features. No training.
  • AI feature: Floot AI builder; AI features in hosted applications.
  • Location of processing: Not pinned to a region
  • Retention: Not retained (zero data retention).
  • Address: 900 Concar Drive, Floor 5, San Mateo, CA 94402, USA
  • Contact: privacy@fireworks.ai
  • DPA: Fireworks DPA

Baseten Labs, Inc.

  • What it does: AI model inference (open-weight models). Builder prompts; End-User Data when a hosted application uses AI features. No training.
  • AI feature: Floot AI builder; AI features in hosted applications.
  • Location of processing: Not pinned to a region
  • Retention: Not retained (zero data retention).
  • Address: 560 Davis St., Suite 250, San Francisco, CA 94111, USA
  • Contact: privacy@baseten.co
  • DPA: Baseten DPA

Cerebras Systems Inc.

  • What it does: AI model inference for the Floot AI builder: builder prompts, project files and chat. Never receives End-User Data.
  • AI feature: Floot AI builder.
  • Location of processing: Not pinned to a region
  • Retention: Kept while the business relationship lasts, then deleted or returned, per its DPA.
  • Address: 1237 E. Arques Ave., Sunnyvale, CA 94085, USA
  • Contact: General Counsel: privacy@cerebras.ai
  • DPA: Cerebras DPA (provided through its trust center)

fal – Features & Labels, Inc.

  • What it does: Image generation from builder image prompts. Never receives End-User Data or project code.
  • AI feature: Floot AI builder (image generation).
  • Location of processing: Not pinned to a region
  • Retention: Requests sent with storage turned off, so inputs and outputs are not stored; generated image files are held briefly for download.
  • Address: 2261 Market St. Suite 10467, San Francisco, CA 94114, USA
  • Contact: support@fal.ai
  • DPA: fal DPA

TypeSafe AI, Inc.

  • What it does: AI evaluation (typed answers) for AI features in hosted applications. End-User Data a hosted application sends for evaluation. No training.
  • AI feature: AI features in hosted applications (evaluation).
  • Location of processing: Not pinned to a region
  • Retention: As long as necessary to provide the service, per its DPA.
  • Address: 255 California St, Suite 1300, San Francisco, CA, USA
  • Contact: privacy@typesafe.ai
  • DPA: TypeSafe DPA

Stripe, LLC

  • What it does: Floot Payments (Stripe Connect) for hosted applications that sell goods or services: buyer and payment data. Stripe also acts as an independent controller for some processing.
  • Location of processing: United States
  • Retention: Term of the Agreement; payment records as required by law.
  • Address: 354 Oyster Point Blvd, South San Francisco, CA 94080, USA
  • Contact: privacy@stripe.com; DPO: dpo@stripe.com
  • DPA: Stripe DPA

Apple Inc.

  • What it does: Apple Push Notification service (APNs): delivery of native push notifications to iOS devices, including notification content.
  • Location of processing: Global
  • Retention: Until delivered or expired.
  • Address: One Apple Park Way, Cupertino, CA 95014, USA
  • Contact: dpo@apple.com
  • DPA: Apple Developer Program License Agreement (no separate DPA offered)

GitHub, Inc.

  • What it does: GitHub Actions: builds of customers' native app code, including signing materials.
  • Location of processing: United States
  • Retention: Build logs and artifacts per repository retention settings.
  • Address: 88 Colin P. Kelly Jr. St, San Francisco, CA 94107, USA
  • Contact: privacy@github.com; DPO: dpo@github.com
  • DPA: GitHub DPA