Sub-processors
These are the third-party services Onflux uses to run the product. Each one processes some personal data on our behalf, under contract, and only to provide the service. We update this page before adding a new sub-processor that handles personal data.
| Service | What it does | Data involved | Region | Policy |
|---|---|---|---|---|
| Supabase | Authentication, database and file storage | Account details, itineraries, client records, uploads | United States | Policy |
| Vercel | Application hosting and edge delivery | Request metadata, IP addresses | United States | Policy |
| Stripe | Payments and subscription billing | Billing name, email, payment method (card data never touches Onflux) | United States | Policy |
| Resend | Transactional and automated email delivery | Recipient email address, subject, message body | United States | Policy |
| Anthropic | AI assistant, AI import and Onflux Automations | The content you submit to those features (briefs, inquiries, itineraries) | United States | Policy |
| Google (Places & Maps) | Venue and place lookup, static maps | Destinations, venue names and addresses you enter | United States | Policy |
| AviationStack | Flight status lookup | Flight numbers and travel dates you enter | United States | Policy |
| Upstash | Rate limiting and abuse prevention | Short-lived keys derived from IP address or account id | United States | Policy |
| Open-Meteo | Weather forecast on itinerary and share pages | Destination name and coordinates, travel dates, and the visitor's IP address (the request is made by the visitor's browser) | European Union | Policy |
| CARTO (basemaps) | Map tiles for the trip map | Map tile coordinates for the trip's locations and the visitor's IP address (tiles are loaded by the visitor's browser). Tile data © OpenStreetMap contributors. | United States / European Union | Policy |
AI processing
Content you submit to the AI assistant, AI import or Onflux Automations is sent to Anthropic to generate a response. Anthropic does not use business-tier API content to train its models. Generated drafts are stored in your Onflux workspace so you can review them before anything is sent.
International transfers
Onflux and its sub-processors are based in the United States. If you or your travellers are outside the US, your data is transferred to and processed in the US.
Data processing agreement
If you need a signed DPA, email privacy@onflux.co and we'll send one.