Legal
Subprocessors
Kameron Tanseli uses the companies below to run Garasu. This list is part of the Privacy Policy and the Data Processing Addendum. We will post additions here before we put a new subprocessor into production where we reasonably can, and we will keep this page dated.
| Company | Role | Typical location | Data involved | Privacy notice |
|---|---|---|---|---|
| Netlify | Hosts the website and app. | United States | Site traffic, account pages you load, logs | Privacy notice |
| Supabase | Authentication, Postgres, row-level security, realtime, and edge functions (including MCP). | United States / EU (project region) | Account email, hashed password, sessions, organisation and product data | Privacy notice |
| OpenRouter | Routes embeddings, matching decisions, and learning titles/summaries to model providers. Endpoints are configured not to train on your data. | United States | Experiment text, hypotheses, result summaries, learning titles | Privacy notice |
| PostHog | Product analytics for the site and app. A cookie and persistent id are stored only after you accept analytics. If you reject, the visit is counted with a server-side hash and nothing is stored in the browser. | European Union (Frankfurt) | Pages viewed, referrer, device, and your account id if you are signed in and accepted analytics | Privacy notice |
| X Corp. | Advertising pixel, only after you accept marketing cookies. | United States | Device identifiers, pages viewed, conversion events | Privacy notice |
| Google (Forms) | Support form linked from the site. | United States | Whatever you type into the support form, plus Google account signals if you are signed in to Google | Privacy notice |
| Resend | Sends account email when experiments are imported or ideas are generated. | United States | Account email address and project name | Privacy notice |
AI model providers
OpenRouter routes inference. Customer Content may be processed by Google (embeddings), OpenAI (embedding fallback and learning titles/summaries), Xiaomi (learning-title fallback). Those providers see prompt text from experiment names, hypotheses, result summaries, and learning titles. All AI endpoints we call are configured not to train on your data. We do not train a Garasu model of our own on Customer Content. OpenAI, Google, and Xiaomi models are hosted on United States servers. All models we call through OpenRouter are served from the United States. We do not extract or redact personal information from experiment hypotheses, names, or other metadata. You are responsible for not putting personal data in Customer Content you send to Garasu.
Optional tools
PostHog and the X pixel follow your cookie choice. If you reject analytics, PostHog does not store a cookie. Google Forms only receives what you type into support.