Your workspace data lives in India. The services below are the only ones that receive any part of it. We will update this page before adding a sub-processor that handles personal data, and customers on a written agreement can ask to be notified of changes.
We choose these, we contract with them, and we answer for them.
| Who | What they do | What they receive | Where |
|---|---|---|---|
| Cloudflare | Runs the application, the API and the website; stores uploaded files (R2); routes inbound mail; carries audio and video for calls | All request traffic; every file you upload; raw inbound email to your @in.gigroot.co address | Global edge network |
| PlanetScale (PostgreSQL, on AWS) | The application database — the system of record for everything in your workspace | All workspace data | India (ap-south-1) |
| Anthropic | The AI behind email triage, document generation, resume reading, the Root assistant and the monthly performance summary | Only the content of the specific item being worked on. See "What reaches an AI model" below | United States |
| Brevo | Sends transactional email (invitations, notifications, invoices) when you have not connected your own sender | Recipient address and name, subject, message body, attachments | European Union |
| Google (Firebase Cloud Messaging) | Delivers push notifications to phones | Device token; notification title and body, which can contain a name or message preview | Global |
| Google (reCAPTCHA) | Blocks bots on public job applications | Applicant's IP address and browser signals | Global |
| Google (Fonts) | Serves the typefaces the app is set in | Visitor's IP address and browser, on page load | Global |
| exchangerate-api.com / exchangerate.host | Daily currency conversion rates | Currency codes only — no personal data | Global |
| ipwho.is | Guesses a visitor's country to preselect a currency | Visitor's IP address | Global |
| OpenStreetMap | Draws the map on field-visit records | Viewer's IP address and the map area being viewed | Global |
| Meta (Pixel and Conversions API) | Measures our own advertising, on the public marketing pages and sign-up only — never inside the app | Visitor's IP address and browser, the page viewed; at sign-up a hashed email | Global |
These receive data only because you connected them with your own account and keys. Your agreement is with them, not with us, and disconnecting any of them leaves the rest of GigRoot working.
| Who | What they do | What they receive | Where |
|---|---|---|---|
| Razorpay / Stripe | Takes online payment for your invoices, into your own account | Amount, currency, invoice reference; Stripe also receives the payer email | Per provider |
| Your own Anthropic or Google Gemini key | Runs the AI features on your account instead of ours | Same as the platform AI row | Per provider |
| Your own Brevo account | Sends email from your domain instead of ours | Recipient, subject, body, attachments | European Union |
| Twilio / Exotel | Calls and SMS from inside the CRM | Caller and recipient phone numbers, call records, recordings where you enable them | Per provider |
| WhatsApp (Meta), Slack, Microsoft Teams, Google Chat | Two-way messaging channels into your inbox | Message content and sender identifiers | Per provider |
| Apollo.io, Hunter.io, Serper | Lead search and contact enrichment, if you switch them on | Search criteria; these services return third-party contact details to you | Per provider |
AI features send only the item being worked on — never your whole database, and never on a schedule of their own. Nothing you send is used to train anyone's model.
Inbound email triage
The sender, the subject and roughly the first 4,000 characters of the message body, so it can be filed and, where it is a support issue, turned into a ticket. Project matching also sends your project list and client names.
Document generation and document chat
The document you are writing or asking about, plus the record it was generated from.
Resume reading
A candidate's CV text, to fill in their profile.
Root assistant
The question you ask, and the records the assistant reads to answer it.
Monthly performance summary
Staff names, their points totals and action counts for the month. This one can fall back to our own Anthropic account if you have not configured a key — if you would rather it never left your workspace, turn the report off.
Proposals, bids, assessments and grading
The brief, the draft, or the answer being graded.
Write to [email protected]. If you need a signed data processing agreement for your own compliance file, ask and we will send one.