Sub-processors
Last updated: June 19, 2026
This page lists the third-party service providers (“sub-processors”) that Airo engages to process personal data on our behalf. We require each sub-processor to provide contractual data-protection commitments at least as protective as those we have committed to in our Privacy Policy.
If you would like to be notified by email when this list changes, please write to privacy@airo.email.
Infrastructure & data storage
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| Google Cloud Platform (Google LLC) | Application hosting (Cloud Run), database (Cloud SQL Postgres), object storage, Pub/Sub, KMS, logging | All account, mailbox, and AI data | United States (us-central1) |
| Google Vertex AI / Gemini (Google LLC) | LLM inference for AI features (AutoFile, chat, extractions) | Email content sent for inference at request time | United States |
Authentication & identity
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| Firebase Authentication (Google LLC) | User authentication, OAuth session management | Email address, user UID, sign-in metadata | United States |
| Google OAuth (Google LLC) | Gmail / Calendar / Drive access via OAuth scopes | OAuth refresh & access tokens (encrypted at rest), profile email | United States |
| Microsoft Identity (Microsoft Corp.) | OAuth for Outlook / Microsoft 365 accounts | OAuth refresh & access tokens (encrypted at rest), profile email | United States |
Email & calendar providers
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| Gmail API (Google LLC) | Reading, sending, labeling user email; push notifications | Mailbox content for the connected Google account | United States |
| Microsoft Graph (Microsoft Corp.) | Reading, sending, labeling Outlook / Microsoft 365 mail | Mailbox content for the connected Microsoft account | United States |
Billing & subscriptions
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| RevenueCat, Inc. | Subscription state, entitlements, in-app-purchase reconciliation | Anonymous user ID, subscription state, store transaction IDs | United States |
| Apple Inc. | App Store in-app purchases for iOS users | Apple transaction IDs, refund data | United States / Ireland |
| Google Play (Google LLC) | Play Store in-app purchases for Android users | Play purchase tokens | United States |
Shipment & travel enrichment (only when a relevant email is detected)
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| EasyPost, Inc. | Carrier shipment tracking webhooks | Tracking numbers, carrier identifiers | United States |
| Carrier APIs (UPS, USPS, FedEx) | Tracking status look-ups | Tracking numbers | United States |
Marketing site & analytics
These only process data of visitors to airo.email, not of authenticated mailbox data.
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| Vercel Inc. | Hosting for the marketing site and basic analytics | IP address, page views | Global edge / United States |
| PostHog, Inc. | Product-analytics events on the landing site (cookieless / memory-only mode) | Hashed event IDs, page paths | United States |
| Google Analytics / Tag Manager (Google LLC) | Aggregate site analytics on the landing site | IP address (anonymised), referrer | United States |
| CookieYes Ltd. | Cookie consent banner on the landing site | Consent records | European Union |
Operational tools (no end-user mailbox data)
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| Doppler, Inc. | Secret management for engineering | No end-user personal data | United States |
App delivery & monitoring
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| Expo (650 Industries, Inc.) | Over-the-air mobile app updates (EAS Update) and mobile app performance monitoring (EAS Observe) | Pseudonymous per-installation identifier, IP address, device / OS / app-version metadata, app performance metrics | United States |
International data transfers
Our primary infrastructure is hosted in the United States. For users in the European Economic Area, the United Kingdom, and Switzerland, transfers to the United States are governed by the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum.
Changes to this list
We will publish updates to this list before adding a new sub-processor that processes personal data. To request advance notice by email, write to privacy@airo.email.