Subprocessor list

1. Purpose

This page lists sub-processors that process personal data on behalf of DeepDive, Inc. in connection with Clavis.

It supplements section 5 of the Privacy Notice. We update this list when sub-processors change in a material way.

2. Sub-processors

Cloudflare, Inc. (United States) — cloud infrastructure and security services (including bot protection at registration, when adding or replacing a passkey, and during account recovery). Persistent data region: the European Union. The provider defines that region only as the European Union. Short-lived data (authentication procedures, consent records, and rate limiting) is held without a region setting and is replicated without regional limitation. Data categories: account identifiers, authentication metadata, session records, network metadata, and security logs as described in the Privacy Notice.

On the country of storage. The provider defines this region only as "the European Union" and does not identify the member state in which data is stored, so we are unable to identify it either. In place of a country name, we can indicate the range of candidate countries — EU member states in which the provider operates facilities for that region. The provider does not publish this list, so we provide it as a current status with the date of our confirmation ([email protected]). See section 7 of the Privacy Notice.

By the provider's design, some internal identifiers may also be recorded outside that region for billing and troubleshooting.

3. Recipients that are not sub-processors

Polar Software Inc. (United States; registered office 3500 South DuPont Highway, Dover, DE 19901) — merchant of record for paid features (purchase, invoices, and usage metering). Polar is not our sub-processor: it also handles the data for its own purposes under its privacy notice (https://polar.sh/legal/privacy-policy, effective 8 September 2026). Data we provide: the account identifier Clavis assigns to the person (not an email address or a name), the organisation identifier, the feature being purchased, and, after purchase, the usage of that feature (counts and times). We provide it only with the purchaser's consent given before the purchase starts; the information for that consent is in section 5 of the Privacy Notice. Polar collects payment details, including card numbers, on Polar's site. Polar may transfer personal data to the United States, Canada, or other destinations; we do not identify a single country of storage. Purchase moves the person from a Clavis site to Polar's site. We do not load Polar's programs on Clavis sites. Polar is not used to process customer personal data.

4. International transfers

For provision of personal data to a sub-processor (Cloudflare) as a third party located outside Japan, we rely on establishing a system to ensure the continued implementation of equivalent measures as required by the APPI. We do not rely on the recipient being located in a country designated as providing an equivalent standard, nor on obtaining your individual consent. On request we will tell you, without delay, how that system is established, an outline of the measures the recipient takes, how often and how we check them, the country in which the recipient is located, whether that country has rules that could affect those measures and an outline of them, whether there is any obstacle to those measures and an outline of it, and what we do about such an obstacle.

5. Updates

Material changes to this list will be reflected on this page. The last updated date appears at the top of the document.

For questions contact [email protected].