This list forms part of the Data Processing Addendum. A provider processes Customer Personal Data only when the applicable Trails feature or business process uses that provider.
1. About this list
Third Arc Inc. uses the providers below to operate, secure, support, and improve Trails. “Customer Personal Data” has the meaning in the Data Processing Addendum. Processing location describes the principal location used by Trails where known; a provider may process limited information from other locations for security, support, resilience, or content delivery under its applicable data protection terms.
2. Core service subprocessors
| Provider | Purpose and data | Principal processing location |
|---|---|---|
| DigitalOcean | Core cloud infrastructure, storage, content delivery, databases, backups, and uploaded or generated Customer Content. | United States; customer-selected region where available |
| Cloudflare | Network delivery, DNS, security, edge services, and PDF/browser rendering. May process IP addresses, request data, and rendered Customer Content. | Global network; United States administration |
| Amazon Web Services / Remotion | Cloud compute and media rendering for generated training videos; may process guide visuals, audio, text, and output video. | United States |
| OpenAI | Text and multimodal generation and audio transcription; may process prompts, guide text, screenshots or image references, and audio for a requested AI Feature. | United States |
| Google Cloud, Gemini, and Vertex AI | Video and content analysis, generation, translation, and related AI processing; may process uploaded video, audio, screenshots, transcripts, prompts, and generated content. | United States and other configured Google Cloud locations |
| ElevenLabs | Text-to-speech, narration, and customer-requested voice cloning; may process text, voice samples, and generated audio. | United States and European Economic Area |
| PostHog | Product and AI analytics. May process account and workspace identifiers, product events, device and usage data, AI metadata, and truncated AI Inputs and Outputs as described in the Privacy Policy. | United States |
| Typesense | Search indexing and retrieval; may process guide and page titles, text, identifiers, permissions, and related search metadata. | United States |
| Scalekit | Enterprise single sign-on and identity management; may process names, business email addresses, organization identifiers, authentication state, and identity-provider metadata. | United States |
3. Business-service providers
| Provider | Purpose and data | Principal processing location |
|---|---|---|
| Stripe | Payment processing, subscriptions, invoices, fraud prevention, and billing portals; processes billing, transaction, and payment information. | United States and global payment network |
| Mailgun | Transactional email and account communications; processes names, email addresses, message content, and delivery events. | United States |
| Loops | Lifecycle and product email; may process names, business email addresses, account identifiers, contact properties, and product events. | United States |
| Chatlio and Slack | Live chat, customer support, and internal support routing; may process contact information, message content, attachments, and support metadata. | United States |
| Better Stack | Application logging, monitoring, reliability, and incident response; may process request, diagnostic, account, IP, and error information included in logs. | United States and European Economic Area |
| CookieYes | Consent management; processes masked IP address, region, consent choices, consent identifier, and timestamp. | United States and European Economic Area |
| Google Analytics, Google Ads, Google Tag Manager, and Google OAuth | Website analytics, campaign attribution, advertising, tag management, and optional Google authentication; may process account identifiers, device, cookie, usage, advertising, and authentication information. | United States and Google's global infrastructure |
4. Updates and objections
Trails may update this list as providers and features change. For a new subprocessor that will process Customer Personal Data, Trails will post the update at least 15 days before the provider begins processing when reasonably practicable. Urgent security, legal, or service-continuity needs may require shorter notice.
Customers may request subprocessor update notices by emailing[email protected]. A customer may object on reasonable data-protection grounds by writing to that address during the notice period. The parties will work in good faith on a commercially reasonable alternative. If none is available, Trails may terminate the affected feature or Customer may terminate the affected Order as provided in the Data Processing Addendum.