The vendors Gravity engages to help deliver the Platform, what each one processes, where data sits, and how to subscribe to change notices.
To deliver the Gravity platform, XAI Technologies Pvt Ltd ("Gravity") engages a small number of trusted vendors as sub-processors. This page lists them, what they do, what categories of data they process, and the lawful safeguards we rely on for international transfers. It supports our Data Processing Addendum and our Privacy Policy.
1.1. A "sub-processor" is a third party we authorize to process Customer Personal Data on our behalf. Each sub-processor is bound by a written contract that requires data protection terms substantively equivalent to those Gravity owes you under the DPA, including confidentiality, security, audit cooperation, breach notification, and onward-transfer safeguards.
1.2. Cross-border transfers from the EEA, UK, or Switzerland rely on Standard Contractual Clauses (EU SCCs 2021 modules + UK Addendum) and, where appropriate, supplementary measures such as encryption in transit and at rest. Transfers from India follow the DPDPA cross-border rules and any government-notified country list.
| Sub-processor | Service | Data processed | Region(s) | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. | Edge CDN, DDoS protection, WAF, DNS, Workers (gravity.fast hosting), Web Analytics. | IP, request metadata, headers, performance metrics. No raw User Content stored at the edge. | Global edge; configuration in US. | EU SCCs + UK Addendum. |
| Amazon Web Services, Inc. (planned for product workloads) | Compute, storage, vector databases for Agent execution. | User Content, Agent inputs/outputs, telemetry. | ap-south-1 (Mumbai) primary; us-east-1 secondary. | EU SCCs + UK Addendum. |
| Google Cloud Platform (planned, secondary) | Backup compute and managed AI services. | User Content, Agent inputs/outputs. | asia-south1 (Mumbai); us-central1. | EU SCCs + UK Addendum. |
| Supabase, Inc. | Authentication, Postgres database, file storage, OTP delivery. | Account credentials, profile, encrypted session tokens, User-uploaded files. | ap-south-1 (Mumbai). | EU SCCs. |
Agent execution may invoke one or more of the following model providers depending on Agent configuration. Builders disclose the provider in the Agent's metadata; Users see it before execution. Where a provider offers a "no-training" option, Gravity uses it.
| Sub-processor | Service | Data processed | Region(s) | Training opt-out |
|---|---|---|---|---|
| Anthropic, PBC | Claude API for Agent reasoning. | Prompts and outputs of the executing Agent. | US (with EU residency available). | Yes — Gravity uses non-training endpoints. |
| OpenAI, OpCo, LLC | GPT API for Agent reasoning and embeddings. | Prompts and outputs of the executing Agent. | US (with EU/EEA residency where available). | Yes — API data is excluded from training by default. |
| Google LLC (Gemini API) | Gemini API for Agent reasoning and image/audio generation. | Prompts and outputs of the executing Agent. | US, EU. | Yes — Gemini API data is not used to train models. |
| Mistral AI SAS (planned) | Open-weight model API for select Agents. | Prompts and outputs. | EU. | Yes (paid tier). |
| Sub-processor | Service | Data processed | Region(s) |
|---|---|---|---|
| Razorpay Software Pvt Ltd | Payment acquiring for Indian and select international cards, UPI, netbanking; merchant of record for INR transactions. | Card and bank tokens, billing name and address, transaction status, GSTIN where applicable. | India. |
| Stripe Payments India Private Limited / Stripe, Inc. (planned for international cards) | International payment acquiring; Radar fraud screening. | Card tokens, billing data, fraud signals. | India / US / Ireland. |
| Wise Payments Limited (planned) | Builder and Creator payouts in non-INR currencies. | Payee name, IBAN/account, country, payout amount. | UK / EU. |
| PayPal, Inc. (planned) | Builder and Creator payouts via PayPal. | PayPal email, payout amount. | US. |
| Sub-processor | Service | Data processed | Region(s) |
|---|---|---|---|
| Google Workspace (Google LLC) | Internal email, calendar, docs, drive for the Gravity team. | Inbound and outbound support emails; internal documents. | US (admin region). |
| Notion Labs, Inc. | Internal documentation, project tracking. | Operational notes; no production User Content. | US. |
| Linear Software, Inc. | Issue tracking. | Operational notes; bug reports may include user-submitted data when explicitly forwarded. | US. |
| Slack Technologies, LLC | Internal team chat. | Internal communications only. | US. |
| Vercel, Inc. (planned) | Frontend deployment for sub-applications. | Build artifacts, request metadata. | Global edge. |
| GitHub, Inc. | Source control, CI/CD. | Source code; no production User Content. | US. |
| Sentry / Plausible / Posthog (one will be selected) | Error monitoring or product analytics. Selected before launch. | Error stack traces, anonymized event data. | EU/US (provider-dependent). |
Some Agents act on third-party services that you connect via OAuth (e.g., Gmail, Google Calendar, LinkedIn, HubSpot, Salesforce, Notion, Slack). These providers are not Gravity sub-processors; you are the controller of that data flow and your contract is with each provider directly. Gravity acts as your tool to invoke their APIs within the scopes you grant. The provider's privacy policy governs their handling of your data.
7.1. We provide at least thirty (30) days' notice before adding or replacing a sub-processor that processes Customer Personal Data, except where the change is required to address a security or legal emergency.
7.2. Notices are published at gravity.fast/sub-processors and emailed to subscribers. To subscribe, send an email to dpo@gravity.fast with the subject "Subscribe to sub-processor updates."
7.3. If you have a reasonable, documented data-protection objection to a new sub-processor, contact us at dpo@gravity.fast within the notice period. We will work with you in good faith to resolve the concern. If we cannot resolve it, you may terminate the affected services as set out in your DPA.
XAI Technologies Pvt Ltd (operating as Gravity AI) — Privacy Team
Privacy: privacy@gravity.fast
Grievance Officer (DPDPA): dpo@gravity.fast
Registered office: BSR Meghana Residency, 17th B Main Rd, KHB Colony, 6th Block, Koramangala, Bengaluru, Karnataka 560095, India.