Subprocessors
Download PDFEffective date: October 19, 2026Last updated: October 19, 2026
On this page
Exhibit Hub Inc. ("ExhibitHub," "we," "us") uses the third-party providers listed below to host, operate, and support the ExhibitHub platform. A subprocessor is a provider we engage that may process personal data contained in Customer Data on our customers' behalf, as described in our Data Processing Addendum (https://exhibithub.com/legal/dpa). This page forms part of the Data Processing Addendum as Annex C.
Each subprocessor is bound by written data protection terms that are no less protective than our Data Processing Addendum, and we remain responsible for their performance. The platform's application, database, and AI processing run in the United States. Where a provider below processes data in another location, the table says so.
Infrastructure and application
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| Vercel, Inc. | Application hosting, request routing, logging, and performance monitoring. Routing of AI model requests through Vercel AI Gateway. | Customer Data in transit through the application. Request logs, including IP addresses and user identifiers. The AI Gateway does not log prompt or response content. | United States (us-east-1, Northern Virginia) |
| Supabase, Inc. | Primary database, user authentication, and file storage | All Customer Data, including uploaded files. User account and authentication data. | United States (AWS us-east-1, Northern Virginia) |
| Inngest, Inc. | Scheduling and execution of background jobs | User and workspace identifiers and references to stored files. No document content. | United States (AWS us-east-2, Ohio, and Ashburn, Virginia) |
| Twilio Inc. (SendGrid) | Delivery of sign-in and notification emails | Recipient names and email addresses. Notification content, which may include event details. | United States |
AI features
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| Kepler Software, Inc. (Mastra) | Runtime for AI workflows, and diagnostic traces of AI feature activity | Inputs to and outputs of AI features, which may include document contents, file names, user identifiers, and email addresses | United States (compute in Portland, Oregon; diagnostic data in Iowa) |
| ChiselStrike, Inc. (Turso) | Storage of AI workflow state and diagnostic traces | The same data as Mastra | United States (us-east-1, Northern Virginia) |
| OpenAI OpCo, LLC | AI models used by platform features, accessed through Vercel AI Gateway. Also used by our team, through ChatGPT, for support and operational work. | Inputs to and outputs of AI features, which may include Customer Data. Customer Data our team includes in support and operational work. | United States |
| Anthropic, PBC | AI models used by platform features, accessed through Vercel AI Gateway. Also used by our team, through Claude, for support and operational work. | Inputs to and outputs of AI features, which may include Customer Data. Customer Data our team includes in support and operational work. | United States |
Support, analytics, and business operations
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| PostHog, Inc. | Product analytics and in-app session recordings | User identifiers and email addresses, in-app usage events, and recordings of activity within the platform | United States (PostHog US Cloud) |
| Intercom, Inc. | In-app support chat and help center, including AI-assisted answers (Fin) | Name, email address, and company of Users who contact support. Support conversation content, which may include Customer Data shared in a conversation. | United States |
| Google LLC (Google Workspace) | Email, calendar, and file storage for support and customer communications | Contents of emails and files exchanged with us, which may include Customer Data | United States (Google Workspace data region set to the United States) |
| Attio Ltd. | Customer relationship management, including synced email and calendar | Contact and account details of customer personnel. Email correspondence with us, which may include Customer Data shared in support or account conversations. | United States (Google Cloud) |
| Granola, Inc. | Notes and transcripts of customer calls | Names of call participants. Call transcripts and notes, which may include Customer Data discussed on a call. Audio is not stored. | United States (AWS) |
| Stripe, Inc. | Payment processing, billing, and invoicing | Billing contact details and transaction records. Card details are collected directly by Stripe and never pass through ExhibitHub systems. | United States |
AI providers: training and retention
None of the providers below may use Customer Data to train or improve their models under our arrangements with them, as we have configured them. The table states how long each retains the inputs and outputs of AI processing.
| Provider | Used to train models | Retention of inputs and outputs |
|---|---|---|
| OpenAI, through Vercel AI Gateway | No | Up to 30 days for abuse monitoring, then deleted |
| Anthropic, through Vercel AI Gateway | No | Up to 30 days for abuse monitoring, then deleted |
| Vercel AI Gateway | No | Does not store prompt or response content. Usage metadata only. |
| ChatGPT and Claude (team use) | No | Kept in our workspace until deleted. Deleted conversations are removed from the provider's systems within 30 days. |
| Mastra and Turso (diagnostic traces) | No | 15 days, then deleted |
| Intercom Fin | No | Intercom's AI providers do not store inputs or outputs (zero data retention). Support conversations are kept in Intercom until deleted. |
| Granola | No | Audio is not stored. Transcripts and notes are kept until deleted. |
Providers used by our subprocessors
Our subprocessors may engage their own providers to deliver their services, and are contractually required to disclose them. On written request, we will identify the providers engaged by any subprocessor that processes personal data on your behalf, and point you to that subprocessor's own published list.
Notice of changes
We will notify subscribed customers at least 30 days before a new subprocessor begins processing personal data. To subscribe, email privacy@exhibithub.com with the subject line "Subprocessor notifications" and the email address you would like notices sent to.
You may object to a new subprocessor on reasonable data protection grounds within the notice period, as described in Section 7 of our Data Processing Addendum. Where a subprocessor must be replaced urgently for security, legal, or continuity reasons, we may make the change before the notice period ends and will notify you as soon as practicable.
Change history
| Date | Change |
|---|---|
| October 19, 2026 | Initial publication |