Infrastructure — always used
These process data for every ConverseKit deployment regardless of configuration.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare | Hosting, CDN, rate limiting, widget delivery | All traffic in transit; IP addresses for rate limiting | Global edge |
| Supabase | Database, authentication, file storage | Transcripts, leads, accounts, knowledge base | Regional (project-dependent) |
AI providers — selected per bot
Each ConverseKit customer chooses which AI provider answers their visitors, and may change it at any time. Only the selected provider receives conversation content: the visitor's message, recent messages from that conversation, and any relevant passages from the customer's own knowledge base.
If you are a visitor wanting to know which provider received your message, ask the business whose website you used — they hold that setting. If you are a customer, your current provider is shown in your dashboard, and you are responsible for choosing one appropriate to your own obligations.
| Provider | Used for | Notes |
|---|---|---|
| OpenAI | Chat, embeddings | API tier; not used for training |
| Anthropic | Chat | API tier; not used for training |
| Google (Gemini API) | Chat | Paid API tier; free tiers may be used for improvement — check your key's tier |
| Google Cloud (Vertex AI) | Chat | Enterprise terms; not used for training |
| Groq | Chat | Fast inference of open models |
| OpenRouter | Chat | A router: forwards to a further upstream provider that varies by model |
| DeepSeek | Chat | Processing may occur in China |
| Mistral | Chat | EU-based |
| Together AI | Chat | Hosted open models |
| Cloudflare Workers AI | Chat, embeddings | Platform default for embeddings |
Self-hosted and custom endpoints
Customers may point a bot at Ollama, LM Studio, or any OpenAI-compatible endpoint they operate or select themselves. In that case no third-party AI provider is involved on our side, and the endpoint is outside our control entirely. The customer configuring it is responsible for where that data goes and for disclosing it in their own privacy notice.
Destinations a customer configures
A customer can set a webhook so new leads are posted to a system of their choosing — a CRM, a chat tool, an internal endpoint. Those receive data at the customer's direction and are not our sub-processors; the customer's own privacy policy governs them.
On model training
We do not use customer content or visitor conversations to train AI models, and we select API tiers where the provider's contractual default is that they do not either. We cannot independently audit any provider's internal practices, and free or consumer tiers at some providers carry different terms from their paid APIs — noted above where we are aware of it. If this matters to your compliance position, choose a provider whose enterprise terms you have reviewed.
Changes to this list
We will update this page when we add or remove an infrastructure sub-processor, and notify account holders by email at least 30 days before an addition takes effect, so there is time to object. The AI provider list changes as we add vendor support; adding a vendor to the catalogue does not send anyone's data to it, because it only ever receives data once a customer selects it.
See also Privacy Policy and Terms of Service. Questions: mukeemoha@gmail.com.