Everyone who touches your data.

Supabase, Inc.

Receives: All account data, case data, and uploaded document files.
Why: Authentication, database, and file storage. Data is held in the United States (AWS us-east-2, Ohio).

Vercel, Inc.

Receives: All request traffic, including data processed server-side while you use the Services.
Why: Application hosting and content delivery. Served from the United States (iad1).

Stripe, Inc.

Receives: Billing name, billing address, payment method details, and transaction events.
Why: Payment processing. Card details go to Stripe directly; we never receive or store full card numbers.

Anthropic PBC

Receives: The images and PDFs you upload to PassVault, and the text extracted from them.
Why: Reading your documents to extract names, dates, and places for eligibility and form prefill. Under Anthropic's Commercial Terms, Anthropic may not train its models on this content, and inputs and outputs are deleted within 30 days.

OpenAI, L.L.C.

Receives: The images and PDFs you upload to PassVault, and the text extracted from them.
Why: Reading your documents to extract names, dates, and places for eligibility and form prefill. Under OpenAI's Business Terms, OpenAI may not train its models on this content, and inputs and outputs are deleted within 30 days.

Google LLC

Receives: Your email address, name, profile photo, and provider identifier — only if you choose to sign in with Google.
Why: Federated sign-in.

Cloudflare, Inc.

Receives: Your IP address and a browser challenge token.
Why: Turnstile bot challenge on the sign-in entry point, to stop automated abuse.

Loops

Receives: Your email address and notification metadata.
Why: Transactional and notification email. Documents, document links, and case file contents are never sent by email.

Cal.com, Inc.

Receives: Your name, email address, and booking details.
Why: Scheduling and managing Family Kickoff calls.

Geoapify GmbH

Receives: The address and place text you type into an address field.
Why: Address and place autocomplete. Requests are proxied through our servers.

FamilySearch International

Receives: Your authorisation to connect, and the genealogical records you choose to import.
Why: Importing your existing family tree — only when you connect the account yourself.

Lob.com, Inc.

Receives: Your name and mailing address, and the contents of a printed kit.
Why: Printing and posting a physical kit to you, where that is part of what you bought. Not used unless that fulfilment path is enabled for your order.

PostalMethods Ltd.

Receives: Your name and mailing address, and the contents of the packet we print for you, which include your completed application form and the copy of your photo ID.
Why: Printing and posting your completed record request to you, in colour, single sided, First Class, with a reply envelope already addressed to the issuing office. The account is held by CitizensOS Inc. Not used unless physical mail is enabled for that record.

TrustedSite

Receives: Page-load telemetry from visitors to our public site.
Why: Site verification trustmark on public marketing pages. It does not receive account or case data.

PostHog, Inc.

Receives: Pseudonymous funnel identifiers, an account UUID after signup, minimized product-use and payment event metadata, and ordinary network metadata associated with event delivery.
Why: Cookieless launch-funnel measurement in PostHog Cloud US (Virginia). We do not send email, name, family, case, document, or ancestor identifiers, document contents, raw survey answers, or URLs and query strings; advertising, autocapture, session replay, and person profiles are disabled.

Featurebase (CORDNET OÜ)

Receives: Your account email, an internal account identifier, the feedback you choose to submit, optional screenshots you choose to attach, and ordinary connection and device data.
Why: Providing the in-app feedback tool and managing product requests and bug reports. We do not send your family case, relatives, or documents unless you choose to include that information in your feedback or screenshot.