Sage operates with a small, carefully chosen set of third-party service categories. Each one handles a narrow slice of the product; none see more than they need to. We never sell data, never share it for advertising, never use it to train external models.
If we add, remove, or materially change a sub-processor category we'll update this page and bump the version on our privacy notice.
| Category | What it does for Sage | Data shared | Region | DPA |
|---|---|---|---|---|
|
Cloud infrastructure Hosting |
Runs the API server, database, and static frontend hosting. | All operational data — encrypted at rest, accessed only by Sage's own code. | US | ✓ In place |
|
AI language model AI |
Generates the intelligence profile, mentor replies, weekly briefs, Imagine snapshots, and letter drafts. | The prompt content for each generation + the model's response. Provider does not train on Sage inputs. | US | ✓ In place |
|
Payment processing (Merchant of Record) Billing |
Handles subscription checkout, recurring charges, tax filing, and refunds. Sage never sees card numbers. | Your name, email, country, billing address. Sage stores only the processor's customer / subscription IDs. | Global (MoR) | ✓ In place |
|
Transactional email Communication |
Sends welcome emails, payment-failure notices, weekly digests, and grievance acknowledgements. | Your email address, name, and the message body being sent. | US (EU presence available) | ✓ In place |
|
Content delivery + DDoS protection Edge |
Edge caching for the marketing site + DDoS protection. No application logic runs at the edge. | Standard HTTP request metadata only (IP, user-agent). | Global anycast | ✓ In place |
To make the privacy posture concrete, here's what Sage doesn't use — and won't add without re-prompting you for consent:
We're evaluating an India-domestic payment route (UPI / netbanking) for Indian customers. Before going live we'll update this page and prompt for re-consent inside the app if it materially changes what data is shared.