How to read this document. It describes how Pinevon and GorZesk are built and operated today. If a sentence is unclear or you think it does not match what you see in the product, write to hello@pinevon.com and we will answer and correct it. Before a material change takes effect we publish the new version here with a new version number and effective date.
Current subprocessors
Pinevon uses the providers below to run the Services. “Configured” means in use; “Optional” means used only when the feature or fallback is enabled. We add or replace subprocessors only after a data-protection review and with notice as described in the DPA.
| Provider | Purpose | Data involved | Status |
|---|---|---|---|
| Supabase | Identity, database and file storage | Account, profile, product data, files | Configured |
| Vercel | Website and web-app hosting, edge delivery | Requests, IP addresses, logs | Configured |
| Render | GorZesk (formerly Skerry and Anchor) backend API hosting | Product API traffic and data in transit | Configured |
| Resend | Transactional and support email delivery | Recipient email, message content | Configured |
| Google (Gemini API) | AI-generated replies | Conversation content sent for a reply | Configured |
| Groq | AI-generated replies (fallback) | Conversation content sent for a reply | Optional |
| OpenAI | AI-generated replies (fallback) | Conversation content sent for a reply | Optional |
| Anthropic | AI-generated replies (fallback) | Conversation content sent for a reply | Optional |
| FastSpring / Paddle / Stripe (as enabled) | Payment processing and tax as merchant of record or processor | Billing contact, plan, payment status | Optional — enabled per product when production approval is complete |
| Meta (WhatsApp / Messenger) | Customer messaging channels the business connects | Message content and identifiers for connected channels | Optional — only when a business connects a channel |
Changes and notice
To be told before a change, email privacy@pinevon.com with the subject “Subprocessor notices”. Customers with a DPA are notified at least 14 days before a new subprocessor starts processing their data.