The list
| Service | What for | What it gets | Where | When | Protection | Since |
|---|---|---|---|---|---|---|
| Google Cloud | Runs Avokaido and stores its data | Everything we store | Belgium (EU) | Always | DPF + SCCs | In use |
| Anthropic (Claude) | AI for Avo Builder, Avo Monitor and the suggestion box | Code, prompts, suggestion chats, outlines of the page a suggestion box visitor is on, facts the customer’s app offers to answer their questions, and screenshots | USA | Always (the default model) | SCCs | In use |
| OpenAI | AI | Code and prompts | USA | Only if your admins choose it | SCCs | In use |
| Google Gemini | AI | Code and prompts | USA | Only if your admins choose it | DPF + SCCs (paid use) | In use |
| Berget AI | AI that runs in Sweden, including open models such as Mistral | Code and prompts | Sweden | Only with your own key | Stays in the EU | In use |
| GitHub | Where your code lives, and how we reach it | Your repositories | USA | Always | DPF + SCCs | In use |
| Stripe | Payments | Billing details and card | USA and EU | Paid plans | DPF + SCCs | In use |
| SendGrid | Sends our emails | Email addresses and the emails | USA | Always | DPF + SCCs | In use |
| Google Workspace | Our own email and calendar | Emails you send us; for a booked demo, your name, email and the time in a calendar invite with a Google Meet link | Google’s data centres, including the USA | Always | DPF + SCCs | In use |
| Linear | Files requests as issues | The requests sent there | USA | Only if connected | SCCs | In use |
| Jira | Files requests as issues | The requests sent there | Where your Jira is | Only if connected | DPF + SCCs | In use |
| Appetize (streamed test devices) | Streams a workspace’s mobile app on a cloud device while a developer tries a change | Unsigned test builds of the app, and what is done in the session | USA | Only when a developer opens the Phone tab | SCCs (to confirm) | 2026-12-05 |
| Google Drive | Saves files an app built with Avokaido makes, such as a signed agreement, into the Google Drive its user connects | The file and its name (not kept by us), the connected account’s email, and a sign-in key that reaches only the files we put there | Google Ireland or Google LLC (USA), by the account | Only when an app’s user connects their Google Drive | DPF + SCCs | 2026-12-10 |
| Microsoft (OneDrive and SharePoint) | Saves files an app built with Avokaido makes, such as a signed agreement, into the OneDrive or SharePoint its user connects | The file and its name (not kept by us), the connected account’s email, and a sign-in key for that account’s files and sites | Microsoft Ireland, data where the account keeps it | Only when an app’s user connects their Microsoft account | DPF + SCCs | 2026-12-10 |
| Google Analytics and Ads | Website statistics and ad results | Visit data and ad clicks | USA | Only after Accept | DPF + SCCs | In use |
DPF is the EU–US Data Privacy Framework. SCCs are the EU’s standard contract clauses, part of each provider’s data processing agreement.
Services you connect with your own account, such as your own AI keys, Vercel or Supabase, work for you under your own contract, so they are not on this list.
When it changes
We email workspace owners at least 30 days before a new service starts getting their data, and add the date it starts to this page. You can object.