Subprocessors

Stirling PDF, Inc. uses the following subprocessors to provide the Services. Complete customer files are never transmitted to any AI provider. Limited derived content — prompts, queries, and extracted text excerpts — is customer content, may contain personal data, and is transmitted only as described below. File hashes, prompts, and excerpts are treated as customer data.

• Amazon Web Services — Contracted service: Cloud infrastructure and storage for Stirling Cloud · Data processed: Customer files (encrypted at rest), account and usage data · Applies to: Stirling Cloud

• Supabase — Contracted service: Account and workspace data infrastructure · Data processed: Account, workspace, and configuration data · Applies to: All deployments (account layer)

• Google — Contracted service: Transactional and operational email delivery · Data processed: Names, email addresses, message content of service emails · Applies to: All deployments

• Anthropic — Contracted service: AI models (Claude) powering the Stirling Assistant and AI-assisted features · Data processed: Prompts and queries (derived from customer content; may contain personal data) — never complete customer files · Applies to: AI features, where used

• Voyage AI — Contracted service: Embedding models for retrieval features · Data processed: Extracted text excerpts (derived from customer content; may contain personal data), solely to generate embeddings, only where the customer enables retrieval features — never complete customer files · Applies to: Retrieval features, where enabled

• PostHog — Contracted service: Product telemetry and usage analytics · Data processed: Pseudonymous usage events and diagnostic data (treated as personal data where applicable) — never file content · Applies to: Hosted Services + website

• Google LLC (Google Analytics / Google Tag Manager) — Contracted service: Website usage measurement and tag delivery · Data processed: Pseudonymous usage and device data (cookie identifiers, pages viewed) — never file content · Applies to: Website + hosted-Services entry points

Independent controllers (not subprocessors): Stripe — payment processing; payment card details go directly to Stripe, which acts as an independent controller for them.

Neither AI provider uses customer data for model training (contractually confirmed).

Self-hosted and air-gapped deployments: customer file content and file names remain in the customer's environment; Stirling receives license-validation and metering data only (process counts, file sizes, file hashes — never file names or content). AI features, where used from self-hosted deployments, transmit derived content as described above.