The following third-party service providers process personal data on behalf of Mitlus. This list is maintained in accordance with GDPR Article 28.
Items you mark as confidential (grant applications, patent matters and files) are processed only by AI providers that do not train on your data: Google Gemini (Vertex AI, or the paid Gemini API, which keeps prompts up to 55 days for abuse checks) and Kimi K3 on Fireworks or Baseten with zero data retention. When the private AI route is off, no AI model reads them.
| Sub-Processor | Purpose | Data Shared | Jurisdiction | DPA Status |
|---|---|---|---|---|
| Google (Sign-In and Drive) | Sign-in with Google, and the optional Google Drive integration (read-only access to one selected folder) | Email, name, profile image, OAuth tokens; for Drive, the files in the selected folder | EU/US | Google Cloud DPA |
| Stripe | Payment processing and subscription billing | Name, email, payment method, billing address, subscription details | US (EU data handling) | Stripe DPA |
| OpenRouter | AI model routing: Mitlus One (Google Gemini 3.8 Flash, on Google Vertex AI / AI Studio) and Mitlus Max (Kimi K3, on Fireworks or Baseten, zero data retention). Also audio transcription for the phone app. | Chat messages, startup context and file text sent in prompts, interview audio | US (inference on Google infrastructure US/EU, Fireworks/Baseten US) | OpenRouter Terms of Service; Google Cloud DPA for Gemini |
| Anthropic | AI model provider (Claude), only when a user selects Claude with their own Anthropic API key | Chat messages, startup context data sent in prompts | US | Anthropic Commercial Terms and DPA |
| Tavily | Web search API for research features | Search queries derived from user prompts | US | Tavily Terms of Service |
| European Patent Office (OPS) | Patent search for the patent features | Search queries derived from user prompts | EU | EPO OPS Terms of Use |
| Hetzner Online GmbH | Application hosting, server infrastructure, and database hosting | All application data in transit and at rest, server logs, IP addresses | Germany (EU) | Hetzner DPA |
Last updated: 8 October 2026. We will update this list when sub-processors change and notify users of material changes via the platform.