Sub-processors.
A sub-processor is a third party that processes personal information on Famli's behalf to help us operate Famli. This page lists every sub-processor we use, what each is used for, and, for our AI providers, the contractual commitment that they may not use your content to train their models. It supplements Sections 4 and 5 of our Privacy Policy.
1. AI sub-processors
Current as of July 18, 2026. This is the canonical, dated list that Section 4 of our Privacy Policy points to.
AI providers receive import content only on the fallback described in Privacy PolicySection 1.5; most imports are read on Famli's own servers and are not sent to any third party. When an input cannot be read on our servers, we transmit the content to the AI providers below under their terms of service and our enforced zero-data-retention configuration, solely to generate the output you asked for. On the AI fallback, photos and scanned images are sent as-is and may include a child's name or face, while text and voice transcripts are sent with the child's profile name replaced by a placeholder. AI features are optional; content is disclosed to these providers only when you choose to use the feature. Neither AI provider is permitted to use your content to train their models.
| AI provider | Purpose | Data it receives | Trains on / retains your data? | Location |
|---|---|---|---|---|
| OpenRouter | US-based AI gateway that receives the fallback content in transit and forwards it to the model below; may transiently log the request | The fallback content. For photos this may include a child's name or face; for text and voice transcripts, the profile name is replaced by a placeholder | No. Not used to train models; sent under zero-data-retention routing, so it is not stored or used for training | United States (gateway) → EU zero-data-retention endpoint |
| Google (Gemini API) | Interprets the fallback content | Same as above | No. Contractually prohibited from using it to train models; sent under zero-data-retention routing, so it is not stored or used for training | European Union (Google Vertex AI, EU region) |
| Device / browser speech service (Apple, Google) | Transcribes voice notes to text, invoked through your device or browser | The audio of a voice note, which may include a child's voice | Governed by the device or browser maker's own terms | Determined by your device/browser maker |
2. Infrastructure & service providers
We share limited data with the providers below, each bound by contract and its own privacy terms.
| Provider | Purpose | Data categories |
|---|---|---|
| Supabase | Database hosting and encrypted document/file storage | All account, family, and uploaded-file data |
| Vercel | Application hosting and infrastructure | Requests; IP addresses (security logs) |
| Upstash | Rate-limiting and ephemeral data | Request metadata |
| Stripe | Payment processing and provider payouts | Name, email, payment method, transaction data |
| Resend | Transactional and digest email delivery | Recipient email address and message content |
| Sentry | Error and performance monitoring | Technical data, which may include user/account identifiers |
| PostHog | Product analytics (only with your consent) | Usage events linked to your account when you are signed in |
| OpenRouter; Google (Gemini) | AI features (see Section 1 above) | Content you submit to AI features |
| Google (Firebase Cloud Messaging) | Push notifications | Device push token |
| Apple (APNs) | Push notifications | Device push token |
We do not use advertising cookies and do not sell your data to ad networks.
3. Changes to this list
We keep this list current and update it when our sub-processors change. For questions about our sub-processors, contact us at support@famli.io. For the full context on what we collect and how we use and share it, see our Privacy Policy.