Skip to content
Sign in

Subprocessors

Who handles data for CyCite

CyCite is operated by Encelyte Ltd, which decides why and how personal data is processed. These are the other companies that process it for us, what they receive, and where. If this list changes, this page changes first.

Last checked: 2026-10-21

  • Anthropic (Claude), through Anthropic's own API

    The AI language model that drafts the answer.

    What it receives
    The question, the earlier turns of the same thread and the passages retrieved from the shelf. Never your name, email or account details.
    Where
    Contract with Anthropic Ireland, Limited. The model runs on Anthropic's infrastructure outside the EU: in the United States or wherever else Anthropic serves it.
    Safeguard
    Anthropic acts as our processor under its data processing terms, which include the European Commission's standard contractual clauses for the transfer. Inputs and outputs are deleted within 30 days (up to two years if a request is flagged under Anthropic's usage policy, or longer where the law requires it) and are not used to train models.

  • OpenRouter

    Backup route: only when Anthropic's API is unavailable, carries the same request to the same Claude model.

    What it receives
    The same text: the question, the thread and the retrieved passages. Never your name, email or account details.
    Where
    The company and its API are in the United States. Requests are pinned to EU endpoints of the model: an EU region of Amazon Web Services (Bedrock) or Google Cloud (Vertex AI).
    Safeguard
    Zero data retention requested on every call: only endpoints that keep no copy of the prompt or the answer and do not train on it are used. Any transfer outside the European Economic Area is under the European Commission's standard contractual clauses.

  • Stripe

    Takes card payments, issues VAT invoices, calculates tax and runs the customer portal.

    What it receives
    Name, email, billing details, card details (entered with Stripe, never on our servers) and plan.
    Where
    European Union and United States.
    Safeguard
    EU–US Data Privacy Framework or standard contractual clauses.

  • Microsoft 365

    Sends verification, password-reset and account emails from [email protected].

    What it receives
    Your email address and the text of the message sent to you.
    Where
    European Union.
    Safeguard
    Processed in the EU under Microsoft's data protection terms.

  • Cloudflare

    Network security and delivery of the site, and a bot check when you create an account or reset a password.

    What it receives
    Network address and request metadata of every visit; the bot check sees the browser, not your account.
    Where
    European Union and United States.
    Safeguard
    EU–US Data Privacy Framework or standard contractual clauses.

What stays with us

Your account, threads, saved items, the signals behind the one free question, and the shelf itself are kept on our own servers in the Republic of Cyprus. Encelyte Ltd runs them; no hosting company holds them.

What no processor gets

No advertising network, no analytics service, no data broker, and no tracker across sites. Search terms may be sent from our servers, without any identity, to outside services when a live lookup is needed.

Changes

We add or replace a processor only after updating this page. Customers with a signed data processing agreement are told by email before a change takes effect, and may object.

Read the privacy page