Service providers
Last updated October 17, 2026
In plain language
Grace relies on other companies to deliver its features. This disclosure describes their roles and the information involved, not private service addresses or infrastructure configurations. Some providers apply only when a feature is enabled. Pivital-operated processing and family-selected destinations are distinguished from external providers below.
| Provider | What they receive | Why |
|---|---|---|
| Supabase | Account identifiers, sign-in sessions, family membership, chats, uploaded documents and extracted text, and security records. | Database, authentication and file storage. |
| Vercel | Browser requests and the data they carry, plus standard hosting logs. | Hosts the Grace web application. |
| Render | API requests, family data needed to process them, background job data, and document content. | Application hosting and background processing. |
| Pivital document processing | Uploaded PDF and Word file contents, returned as extracted text. | Reads documents so Grace can search them. |
| Transactional email provider [name to be confirmed] | Recipient email address, invitation and sign-in links, and message text. | Sends invitations, password resets and sign-in links. |
| AI model providers (Groq, Mistral, OpenRouter, or the provider a family is configured to use) [contract terms to be confirmed] | Prompts, conversation context, and any document text or images you attach to a question. | Generates Grace’s answers. |
| Brave Search, when enabled | The search text of a question that needed web search. | Web search answers. |
| Stripe | Customer and subscription identifiers, seat counts, payment details you enter, and billing events. | Payments and subscriptions. |
| Sentry, if enabled [to be confirmed] | Error and performance details, with message content excluded. | Finding and fixing faults. |
| Family NAS destination, if your family connects one | Files the family chooses to sync, and sync records. | Copies the family’s knowledge base to storage the family controls. |
What remains to be confirmed
[Operations and counsel must confirm the complete active provider list, transactional email provider, any enabled monitoring service, downstream model providers, contractual protections, processing locations, retention periods, and training settings.]
A provider name alone does not establish zero retention, a training opt-out, or a particular processing location. We do not make those assurances in this draft. OpenRouter or another routing provider may send requests to the provider serving the configured model; that recipient must be included in the completed disclosure.
Updates and questions
We will update this disclosure as processing relationships change, with any additional notice required by law or contract. See the privacy policy for collection and use, and AI transparency for what an AI request may contain. Contact Grace with questions.