How to read this list
LittleDraft uses service providers for AI, hosting, authentication and optional analytics. A provider’s GDPR role depends on the activity and the applicable agreement: a processor acts for a controller, while a subprocessor is engaged by a processor. A provider may also act as an independent controller for some purposes.
This is an inventory of services identified in the implementation, not a completed contractual subprocessor register. Actual contracting entities, processing locations, roles and transfer safeguards still need to be confirmed against the relevant accounts and agreements.
Services in the current implementation
On smaller screens, scroll the table sideways to see all details.
| Service & entity | Purpose & data | Location & role | Transfers & documentation |
|---|---|---|---|
| OpenAI API OpenAI Ireland Ltd. or OpenAI OpCo, LLC; contracting entity to confirm. | Generates, translates and researches drafts. Receives selected email context, instructions and authorized style or reference information. | Actual processing locations not verified. OpenAI’s API DPA describes processor processing; it may be a subprocessor where LittleDraft acts as a business customer’s processor, subject to the agreements. | OpenAI’s published DPA discusses standard contractual clauses (SCCs); applicability to this account and transfers needs confirmation. API DPA · OpenAI’s subprocessor list |
| OpenAI Sites OpenAI Ireland Ltd. or OpenAI OpCo, LLC; applicable entity to confirm. | Hosts and supports this website and private admin. May process connection, analytics and admin account data. | Actual hosting and processing locations not verified. OpenAI’s Sites DPA describes processor processing of hosted data; roles for this deployment depend on the applicable terms. | OpenAI’s Sites DPA describes SCCs or adequacy decisions for certain transfers; actual applicability requires confirmation. Sites DPA |
| Cloudflare Cloudflare, Inc. and/or an affiliate; contracting entity to confirm. | Runs the app service, database, delivery and security infrastructure. May process connection metadata, account-related usage and transmitted service requests. | Locations and regional settings not verified. Processor or downstream subprocessor for relevant hosted data, depending on the service and agreement; it may have separate responsibilities for other activities. | Cloudflare publishes SCCs in its customer DPA; their application to each service must be confirmed. Cloudflare SCCs · Privacy policy |
| Auth0 by Okta Okta, Inc. or an affiliate; contracting entity to confirm. | Account sign-in and authentication. Processes account identifiers, email verification and authentication information. | A US-labelled Auth0 endpoint is configured; actual processing and support locations are not verified. Processor or downstream subprocessor for authentication, subject to contract; independent roles for provider operations need confirmation. | Transfer mechanism and coverage for this account are not verified. Auth0 DPA information · Okta privacy policy |
| Google Analytics 4 Google Ireland Limited and/or Google LLC; contracting entity to confirm. | Optional website analytics, only when selected in Cookie Settings. May receive device and browser information, analytics identifiers and interaction data. | Actual processing locations not verified. Google’s analytics terms describe processor processing of customer data, while Google may act independently for separate purposes; applicable roles require confirmation. | Transfer mechanism and property configuration are not verified. Google data processing terms · Analytics cookie information |
| Paddle Contracting Paddle entity and legal role to confirm. | Handles paid Basic and Pro checkout, subscription billing, invoices and cancellation. Processes checkout and billing details; LittleDraft receives subscription and payment status. | Production billing is enabled. Processing locations, contractual roles and retention must be confirmed against the merchant account and agreements. | Applicable transfer safeguards require account-specific review. Paddle privacy policy |
Other services and limitations
The app uses Sparkle to check the LittleDraft update feed at api.littledraft.com, served through its Cloudflare infrastructure. Actual processing locations and connection-log retention still need confirmation. Apple Mail, macOS and a customer’s own email provider handle email under their own relationships with the user. The provider for the support mailbox has not been identified from the source.
Paid Personal and Pro subscriptions use Paddle in production. Historical Stripe code is inactive. Provider-side logging, monitoring and downstream services require confirmation in the relevant account settings.
Enterprise inquiry delivery
When you submit the Enterprise inquiry form, Resend delivers your name, work email, company, team size, and optional message to hello@littledraft.com. The website stores keyed hashes and delivery receipts for abuse prevention and duplicate protection and removes records older than 30 days when the next inquiry is processed. It does not store the inquiry contents in its database. Inquiry contents remain in the recipient mailbox for handling your request. See Resend’s privacy policy.
Business customers
If LittleDraft processes personal data on behalf of your business, contact us to request a data processing agreement or further details. We will review the requested arrangement and applicable terms with you. If your agreement provides for subprocessor change notices, we will use the contact and process agreed with your organization; you can also ask us how to receive information about changes.
Request DPA or data-processing information · Ask about subprocessor change notices
See our Privacy Policy, Cookie Information and AI Transparency page.