Subprocessors
This page lists the third-party service providers ("sub-processors") that process
personal data on behalf of Korely, under Article 28 of the General Data Protection
Regulation (GDPR), to provide Korely Agents Cloud (api.korely.ai,
agent.korely.ai) and the website korely.ai. It is part of our
Privacy Policy, of our
Terms of Service and of our Data Processing
Agreement. We announce a new sub-processor here at least 30 days before it starts
processing personal data.
Korely is operated by Massimiliano Martella (sole trader), based in Italy. Privacy contact: privacy@korely.ai.
Data is stored in the EU. Choose the Europe region to keep model processing in the EU too. Korely Agents Self-hosted runs on the customer's own infrastructure: Korely receives no data from it, and the providers its operator chooses are the customer's own, not ours.
Sub-processors in active use
| Provider | Purpose | Region | DPA / Privacy Policy |
|---|---|---|---|
| Hetzner (Hetzner Online GmbH) | Hosting of the whole service: the API and MCP server, the dashboard, the PostgreSQL database (on an encrypted volume), the embedding model EmbeddingGemma (run inside the service), the background worker and the web server. Holds everything the service stores: account data, customers' memories, facts and vectors, the audit trail, usage records, request logs with IP addresses | European Union (Helsinki, Finland) | DPA · Privacy |
| Google Gemini API (Google LLC and its affiliates) | Language model for projects in the Global region (the default): extracts facts when a memory is written. It receives the text of each memory written, with the end user's identifier and up to ten previous memories of the same end user (300 characters each); the earlier facts a new fact is compared with; and the phrase of a relation the end user has not used before, with a value; a vocabulary for each end user of a project, learned from that end user's facts alone; an end user's facts and values never reach another end user's prompts. Google keeps prompts and responses 55 days to detect abuse and does not use them to improve its products | United States and other countries where Google has facilities (EU SCC and, where available, the EU-US Data Privacy Framework) | Gemini API terms · DPA · Privacy |
| Scaleway (Scaleway SAS) | Language model for projects in the Europe region: gpt-oss-120b, an open-weights model, extracts facts when a memory is written. It receives the same data as above, for Europe projects only. Prompts and outputs are not stored, except the content of a request that causes an abnormal error or that Scaleway detects as malicious, kept temporarily to investigate it (up to two weeks for an error), and are not used for training | European Union (France, Paris region) | DPA · Privacy |
| Firebase Authentication (Google LLC) | Sign-in to the dashboard with Google, Microsoft, GitHub or email and password; sends the address-verification and password-reset emails. Email address, password (for email sign-in, held by Firebase only), Firebase user identifier, sign-in method, IP address and user agent at sign-in. Logged IP addresses are kept a few weeks; a deleted user is removed from live and backup systems within 180 days | United States only (EU SCC and, where available, the EU-US Data Privacy Framework) | DPA · SCC · Privacy |
| Cloudflare, Inc. | DNS of korely.ai; hosting of the website korely.ai (Cloudflare Pages) and its audience measurement, Cloudflare Web Analytics, a script that measures visits and page-loading speed with no cookies and nothing stored on your device; R2 object storage of the nightly database backups, encrypted on our server before upload with a key Cloudflare does not have | Global edge; backups in an R2 bucket under the EU jurisdiction | DPA · Privacy |
| Polar (Polar Software, Inc.) | Payments and subscriptions. Polar is the reseller and merchant of record of the paid plans and top-ups: for what it collects at checkout (name, billing address, payment method) it is an independent controller; for the data Korely shares with it (email address, account identifier, plan) it is our processor | United States (EU SCC and, where available, the EU-US Data Privacy Framework) | DPA · Privacy |
| Resend (Resend, Inc.) | Delivery of operational alerts to Korely's operator only (for example a closure that could not reach Firebase or Polar). Never sends email to customers; the alerts carry random account identifiers and counts, never customers' email addresses or content | United States (EU SCC and, where available, the EU-US Data Privacy Framework) | DPA · Privacy |
| Porkbun (Porkbun, LLC) | Email forwarding: messages sent to korely.ai addresses (info@, privacy@, support@, security@) are forwarded to the operator's mailbox. The sender's address and name, and the content of the message | United States | Terms · Privacy |
| Loops (Loops, Inc.) | Stores the contacts of people who joined a Korely waitlist (email address, plan of interest, sign-up and consent time, version of the consent text), and may send them product updates if they opted in. No form on korely.ai collects new contacts | United States (EU SCC and, where available, the EU-US Data Privacy Framework) | DPA · Privacy |
Sign-in providers (not sub-processors)
When you choose to sign in with Google, Microsoft or GitHub, that provider confirms your identity to Firebase under its own terms and privacy policy, as an independent controller. For a GitHub sign-in, Korely also asks GitHub, once and with the access token GitHub just issued, whether your email address is a verified address of your GitHub account; the token is not stored.
Destinations you choose (not sub-processors)
Webhook endpoints you register, MCP clients you connect, and any application you give an API key to receive data because you send it there. They are under your control.
Recent changes
- 17 October 2026, version 2026-10-17. The language-model rows now list everything the model receives when a memory is written: besides the text, the end user's identifier and up to ten previous memories of the same end user, 300 characters each. The service already sent them; the list was incomplete. No provider changed.
- 12 October 2026, version 2026-10-12-v2. Scaleway: the exception to zero data retention also covers a request Scaleway detects as malicious, as its Specific Conditions for AI Services (version of 7 April 2026) state. Scaleway confirmed in writing that the Generative APIs we use run only in Paris (fr-par), with no transfer outside the EEA.
- 12 October 2026, version 2026-10-12-v1. The list now covers Korely Agents, Cloud and Self-hosted, only. Removed, because the service no longer sends them any data: Sentry, Microsoft (Outlook calendar), Google Calendar API and Firebase Cloud Messaging; Scaleway now serves only the Europe region of Korely Agents. Firebase Authentication serves the Agents dashboard; Resend sends only alerts to Korely's operator; Cloudflare no longer hosts the Agents dashboard, which is served from our server in Helsinki, and its R2 storage holds the encrypted nightly backups of the database. Added Porkbun, which forwards email sent to korely.ai addresses. Notice of a new sub-processor: at least 30 days.
- 11 October 2026, version 2026-10-11-v1. Corrected the link to Google Gemini's data processing terms: the Gemini API is covered by Google's Data Processing Addendum for Products Where Google is a Data Processor and by the Gemini API terms, not by the Google Cloud DPA linked before.
- 6 October 2026, version 2026-10-06-v1. Korely Agents projects have a region. In the Europe region Scaleway SAS (Paris) reads the memories written, instead of Google Gemini; the Global region, the default, stays on Google Gemini. Added this to both entries.
- Earlier versions of this list are available on request at privacy@korely.ai.
Services we explicitly do NOT use
For full transparency, the following services are commonly assumed to be in use by modern web applications but are not used by Korely:
- Google Tag Manager, Google Analytics: replaced by Cloudflare Web Analytics (listed above under Cloudflare; no cookies)
- Meta Pixel, Facebook ads: none
- Hotjar, FullStory, LogRocket, Mouseflow: no session replay tools
- Sentry or any other third-party error tracking: not used by Korely Agents Cloud
- Mailchimp, ActiveCampaign, ConvertKit: not used (the waitlist contacts are on Loops, listed above)
- Intercom, Crisp, Drift, Zendesk: no third-party live chat or ticketing
- Mistral, OpenAI, Anthropic, xAI, OpenRouter: the Korely Agents software can work with them for the operators of Self-hosted installations who choose them, but Korely Agents Cloud does not use them. On the Cloud only Korely can change the providers, and only Google (Global region) and Scaleway (Europe region) are configured. gpt-oss-120b is an open-weights model released by OpenAI and run by Scaleway in Paris: no data goes to OpenAI
Notification of changes
We update this page at least 30 days before a new sub-processor starts processing personal data. Material changes affecting your personal data are also reflected in our Privacy Policy with a new date.
To be told by email, ask privacy@korely.ai. A customer who objects to a new sub-processor on reasonable data-protection grounds can tell us within those 30 days; if we cannot find a solution together, the customer can close the account.
Contact
For privacy questions or to exercise your rights under GDPR (access, deletion, rectification, portability, objection): privacy@korely.ai.
Data Controller: Massimiliano Martella (sole trader), Via della Bastia 15, 40033 Casalecchio di Reno (BO), Italy.
Our Data Processing Agreement is part of our Terms of Service, lists these sub-processors, and is available at privacy@korely.ai.