Subprocessors
Last updated:
These are the third-party companies that process personal data on ChemStitch’s behalf to run the service. Each one receives only the data it needs for the purpose listed. For what we collect and why, see the Privacy Policy; for how data moves through the system, see Security & Data Handling.
Current subprocessors
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Email address, account and subscription records, the structures and documents you save, your AI API key (encrypted) | United States (AWS us-east-1) |
| Vercel | Hosting for the app and this website, server-side API routes, runtime logs | All requests to the app in transit, IP address, browser user agent, security log events | United States (Washington, D.C.); static pages are cached on a global edge network |
| Railway | Hosting for the chemistry API (property calculation, naming) and the AI gateway | Structures sent for computation (as SMILES), your user ID, AI chat requests in transit to the AI providers | United States |
| OpenAI | AI chat and structure recognition from images (when you use them) | Your chat messages, the structure context you send with them, images you upload for recognition | United States |
| Anthropic | AI chat (when you use it) | Your chat messages and the structure context you send with them | United States |
| Stripe | Payments, subscriptions and invoices | Name, email address, billing address, payment card details (held by Stripe, never by us), subscription status | United States |
| Resend | Transactional email (trial, billing and account notices) | Email address, message content, delivery and bounce events | United States |
| PostHog | Product analytics on the app and this website | Pseudonymous user ID, email domain (not the full address), page views and feature-usage events, session recordings of the app (form inputs masked), device and browser, IP-derived location | United States |
| Google Analytics | Website and app traffic analytics, sign-up conversion measurement | Cookie identifier, page views and conversion events, device and browser, IP-derived location | United States |
| Google Fonts | Serving the typefaces on this website (the app hosts its own fonts) | IP address, browser user agent | United States |
| Reddit (advertising pixel) | Measuring visits from our Reddit ads | Cookie identifier, page visits, IP address, browser user agent | United States |
| Sentry | Error monitoring for the app | Error reports and stack traces, request metadata and performance traces, IP address, browser user agent | United States |
| GitHub | Tracking the in-app feedback you send us | Your feedback text and your account email address | United States |
Your own AI key
If you add your own OpenAI or Anthropic API key, your chat requests go to that provider under your account with them, and their terms apply to that processing.
Public chemistry databases
When you look up a compound, the app queries PubChem (U.S. National Library of Medicine) with the compound name or structure identifier. No account information is sent with these lookups.
Changes and questions
We update this page before a new subprocessor starts processing personal data. For questions, or to be told about changes, contact support@chemstitch.ai.