Legal
Subprocessors
Effective date: September 2026
We keep the list of third parties involved in running HackwithClaude short and public. Each one is bound to process data only to deliver the service.
Current subprocessors
| Provider | Purpose | Data processed |
|---|---|---|
| Amazon Web Services (Bedrock) | Model inference and hosting infrastructure | Prompt and completion content, processed in memory for the duration of the request and not retained |
| Upstream model providers | Serving requests for models not hosted on Bedrock (Anthropic, OpenAI, DeepSeek, Z.ai, Qwen, Moonshot) | Only the request routed to that provider; no account identifiers |
| Stripe | Payment processing and invoicing | Billing email, payment method tokens, transaction records. We never see full card numbers |
| Supabase | Authentication, account database and usage metering | Email address, auth identifiers, plan status, token usage counters, sign-up IP for anti-abuse |
| Sign-in with Google | Email address, name and avatar returned by the OAuth consent you approve | |
| Resend | Transactional email (API key delivery, account notices) | Email address and message content |
| Cloudflare | Edge hosting, TLS and DDoS protection | Request metadata such as IP address and user agent |
What is never shared
We do not store prompts or completions, so there is no archive to hand to anyone. No subprocessor receives your conversation history, and none of your traffic is used to train models.
Changes to this list
If we add or replace a subprocessor, this page is updated before the change takes effect for new traffic. Ask @hackwithclaude on Telegram if you need notice of future changes for a compliance review.