Third-Party Services
These are the companies that receive personal information to run iPandith. Each row exists because code in the product calls that service; a test fails the build if a vendor appears here without code reaching it, or reaches it without appearing here.
| Service | What it does | What it receives | Where | DPA / SCCs |
|---|---|---|---|---|
| Clerk | Sign-in and identity: email/password and Google sign-in, session management | Email address, name, Google account identifier when you use Google sign-in, IP address and browser details | United States | In place (verified) |
| Cloudflare | DNS, edge network and the tunnel that connects ipandith.com to our servers; protection against abusive traffic | IP address, request metadata and the content of requests in transit (encrypted end to end to our server) | Global edge network; Canadian requests are normally served from Canadian points of presence | In place (verified) |
| Oracle Cloud Infrastructure | Hosting of the application, its database and encrypted backups | All application data at rest: account, client records, birth data, charts, readings, support messages, usage logs | TODO: confirm - hosting region (OCI region of the ipandith-oci host) | In place (verified) |
| DeepSeek | Primary AI model that writes readings from your computed chart | The name and gender you entered for the person read, their birth date, time and place, the computed chart data (planetary positions, houses, nakshatras, dashas), the reading language, the sections requested, and any question you type. Not your email, account identifiers, client contact details or payment details. | China | In place (verified) |
| OpenAI | Fallback AI model, used automatically when the primary model fails or is unavailable | The same data as the primary model, when the fallback is used | United States | In place (verified) |
| Geoapify | Place search when you type a birth place in the chart wizard or client form | The place text you type, sent from our server (your IP address is not forwarded) | European Union | In place (verified) |
| OpenStreetMap Nominatim | Place search on the single-reading form at /reading, called directly by your browser | The place text you type and your IP address and browser details | United Kingdom / European Union | TODO: confirm - DPA status: OpenStreetMap Nominatim (used by the reading form's place search) |
| Google Fonts | Web fonts loaded by your browser from fonts.googleapis.com and fonts.gstatic.com | Your IP address and browser details when the fonts are fetched; no cookies are set | United States | In place (verified) |
What binds them
Each provider acts under its data-processing terms, which for the EU/UK incorporate the Standard Contractual Clauses and UK Addendum. “Verified” means we have checked that those terms apply to our account; a “TODO: confirm” means we have not yet, and we say so rather than assert it.
Our continuing accountability
Sending data to a provider does not transfer our responsibility for it. We remain accountable for what happens to your information at every provider on this list, including under Australian Privacy Principle 8 for Australian users and Quebec Law 25's requirement to assess a transfer outside Quebec.
What we deliberately do not use
| Not used | Why it is on this list |
|---|---|
| Stripe | Card checkout is integrated in code but switched off in production (PAYMENTS_LIVE_ENABLED is not set); no payment data is collected or sent today |
| PayPal | Integrated in code but switched off in production; no payment data is collected or sent today |
| Resend / Brevo | Email sending is integrated in code but no provider is configured in production (EMAIL_PROVIDER=none); we currently send no email |
| Microsoft Azure / Azure AI Foundry | Not called by the deployed code; a signed DPA exists but nothing uses it |
| Anthropic | Not called |
| Twilio / Meta WhatsApp Business | The WhatsApp daily broadcast is a stub that sends nothing; no messaging vendor is connected |
| Analytics and advertising networks | None. No analytics script, ad tag, pixel or site-verification tag is loaded |
Changes
Adding, removing or relocating a provider publishes a new version of this page and, where it changes what you agreed to, of the Privacy Policy, which you are asked to accept again. Write to contact@ipandith.com with questions.