ZiRA is operated by Blackmass Enterprises Ltd (UK Company No. 16124799). This page lists the third-party providers ("sub-processors") we use to process data on our behalf, what each one handles, where it is located, and the safeguard we rely on for any international transfer. It forms part of, and should be read with, our Privacy Policy. We contract with each provider under its data-processing terms and are completing Data Processing Agreements where these are not already in place.
We review this list as our service evolves and update it when a sub-processor is added or removed. If you would like to be notified of changes, or have questions about any provider, contact us at privacy@askzira.ai.
| Sub-processor | Purpose | Data shared | Location | Transfer safeguard |
|---|---|---|---|---|
| Anthropic PBC | AI chat — primary model provider (generates ZiRA's responses). | Your chat messages and recent conversation context. | United States | Commercial API DPA; EU SCCs + UK Addendum; EU-US DPF (UK extension) where applicable. |
| OpenAI, L.L.C. | AI chat failover (used only if Anthropic is unavailable) and knowledge-base search embeddings. | Your chat messages (on failover); your knowledge-base search queries. | United States | API data-processing terms; EU SCCs + UK Addendum. |
| Google LLC (Google Cloud) | Voice — Speech-to-Text (transcription) and Text-to-Speech (spoken responses). Used only when you use voice features. | Voice audio you record; the text of responses to be synthesised. | United States | Google Cloud DPA; EU SCCs + UK Addendum; EU-US DPF (UK extension). |
| Supabase, Inc. | Database and storage of application data (conversations, sessions, usage counters, security logs). | Conversation records, session identifiers, usage data, security/abuse logs. | European Union (Ireland, eu-west-1) | DPA with EU SCCs + UK Addendum. Data resident in the EU; onward US sub-processors (e.g. AWS) covered by Supabase's DPA. |
| Vercel, Inc. | Application hosting, content delivery, and performance analytics (Vercel Analytics & Speed Insights). | IP address, request metadata, and anonymised performance metrics. | United States / global edge | DPA with EU SCCs + UK Addendum. |
| Brevo (Sendinblue SAS) | Email — waitlist management and contact-form / service communications. | Email address and any message you send. | European Union (France) | EU-based processor under a DPA; processing within the EEA. |
| CARTO (map tiles) | Delivers interactive map tiles (using OpenStreetMap data) on pages that display maps. | Your IP address, only when a map page loads tiles. | United States / EU (CDN) | Standard provider terms; limited to tile delivery. |
| Cloudflare, Inc. (Turnstile) | Optional bot-protection challenge on form and chat submissions. Not currently active (feature-flagged off). | IP address and a challenge token — only if the feature is enabled. | United States / global | DPA with EU SCCs + UK Addendum (if enabled). |
Supabase, Vercel, and our other providers also engage their own sub-processors (for example, cloud infrastructure). Those are governed by each provider's own DPA and sub-processor list, which we review as part of our supplier due diligence.