Service Providers

These are the companies that process personal data for Grasp, what each of them receives, and the commitments that apply. Our Privacy Policy explains the kinds of providers we use and your rights.

Several providers may serve one task, for example a main provider and a backup, or different providers for different languages or countries, and our systems switch between them automatically. Every one of them is listed here and bound by the same rules.

1. Hosting

Cloudflare

• Company: Cloudflare, Inc. (USA)
• What it does: Hosting of the site and the API, database, file storage including our encrypted backups, network protection, bot checks (Turnstile), visit statistics on our public pages (Web Analytics), and the relay for direct calls between devices (Cloudflare Realtime TURN)
• Data: The data Grasp stores, our encrypted backups, IP addresses, addresses and technical details of visits to public pages; for direct calls it relays, the encrypted call audio in transit and the two devices' IP addresses
• Role: Processor
• Safeguard: Data Privacy Framework where the provider is certified, otherwise Standard Contractual Clauses in its data processing terms
• Retention and training: Keeps our data only for us and for as long as our retention periods say (Privacy Policy, section 8)
• Use: Main; all countries

Google Cloud

• Company: Google LLC (USA)
• What it does: Hosts the servers in the United States that run our speech-processing service, including our own noise filter; we operate these servers ourselves
• Data: The audio and text our speech-processing service processes (call audio and captions, voice messages, the sound of video messages and their transcripts, voice recordings, translator sessions, display names and gender form used as hints), held in memory only; server logs with internal IDs
• Role: Processor
• Safeguard: Data Privacy Framework where the provider is certified, otherwise Standard Contractual Clauses in its data processing terms
• Retention and training: Audio and text are held in memory only and never written to disk; server logs are deleted within 30 days
• Use: Main; all countries

2. Call transport

LiveKit

• Company: LiveKit, Inc. (USA)
• What it does: Real-time audio and video transport for calls; through LiveKit Inference, passes the translated text of a speaker with a standard voice to Inworld's ready-made voices, and the audio of voice messages and the sound of video messages to Deepgram for speech recognition
• Data: Call audio, video and captions in transit, display name, internal participant ID, IP address; for a standard voice, the translated text and its language; the audio of voice messages and the sound of video messages sent to Deepgram
• Role: Processor
• Safeguard: Data Privacy Framework where the provider is certified, otherwise Standard Contractual Clauses in its data processing terms
• Retention and training: Under LiveKit's terms, what passes through LiveKit Inference is not stored and not used to train models
• Use: Main for calls; all countries

3. Speech recognition and translation

Soniox

• Company: Soniox, Inc. (USA)
• What it does: Speech recognition and translation in calls and in the translator; speech in standard voices; the clones of voices it cloned (voices created before 29 October 2026); speech recognition of voice messages and of the sound of video messages when neither AssemblyAI nor Deepgram is used for them
• Data: Call audio, translator audio and, when you use the translator, your IP address; voice messages and the sound of video messages in those languages; the recordings and clones of the voices it cloned; display names and your gender form, as hints
• Role: Processor
• Safeguard: Standard Contractual Clauses (controller to processor) with the UK Addendum, in its data processing agreement
• Retention and training: States in its terms that it does not use its customers' content to train or improve its models
• Use: Main for calls and the translator; all countries

AssemblyAI

• Company: AssemblyAI, Inc. (USA)
• What it does: Speech recognition of voice messages and of the sound of video messages; not used in calls
• Data: The audio of voice messages and the sound of video messages, and the language of the speech when we know it
• Role: Processor
• Safeguard: Data Privacy Framework where the provider is certified, otherwise Standard Contractual Clauses in its data processing terms
• Retention and training: Our account is opted out of its model improvement; it deletes the audio and the transcript within 1 day
• Use: Main for voice and video messages, in the languages it supports; all countries

Deepgram

• Company: Deepgram, Inc. (USA)
• What it does: Recognizes speech in voice messages and in the sound of video messages, in languages AssemblyAI does not support
• Data: Those voice messages and the sound of those video messages, and the language of the speech
• Role: Sub-processor, through LiveKit
• Safeguard: LiveKit's terms with its providers
• Retention and training: Under LiveKit's terms, nothing is stored and nothing is used to train models
• Use: Second for voice and video messages, in the languages it supports; not for people in Russia, Belarus, mainland China or Syria

4. Speech synthesis and voice cloning

Inworld

• Company: Theai, Inc. (Inworld AI) (USA)
• What it does: Makes the clone of your voice and speaks your translated speech and the previews of your voice in it; its ready-made voices speak for people with a standard voice, reached through LiveKit
• Data: A part of your voice recording and the clone made from it; in calls, the translated text of what you say and its language; the sentences of the previews of your voice
• Role: Processor
• Safeguard: Standard Contractual Clauses in its data processing addendum
• Retention and training: Acts as our processor under its data processing addendum; its documents do not say how long it keeps call text in its logs
• Use: Main for personal voices and for standard voices in calls; every language but Bosnian; all countries

5. AI language models, directly or through a model router

OpenRouter

• Company: OpenRouter, Inc. (USA)
• What it does: Model router: sends our text to the AI models below
• Data: Chat messages to translate with a few earlier messages of the same chat, voice and video message transcripts, text typed in the translator, text of voice tests, and call phrases to rewrite as statements
• Role: Processor
• Safeguard: Data Privacy Framework where the provider is certified, otherwise Standard Contractual Clauses in its data processing terms
• Retention and training: Every request is sent with data collection denied and zero data retention requested
• Use: Backup for chat translation; main for text typed in the translator, voice tests and rewriting call phrases; all countries

Microsoft Azure (OpenAI model)

• Company: Microsoft Corporation (USA)
• What it does: Hosts the OpenAI model that translates text, and the backup for rewriting call phrases
• Data: The text OpenRouter sends
• Role: Sub-processor, through OpenRouter
• Safeguard: OpenRouter's terms with its providers
• Retention and training: Zero data retention requested with every request
• Use: Backup for chat translation; main for text typed in the translator and voice tests; outside Russia, Belarus, mainland China and Syria

Google (Gemini model)

• Company: Google LLC (USA)
• What it does: Hosts the Gemini model: translates text when the main host cannot answer, and rewrites call phrases first
• Data: The text OpenRouter sends
• Role: Sub-processor, through OpenRouter
• Safeguard: OpenRouter's terms with its providers
• Retention and training: Zero data retention requested with every request
• Use: Backup for text translation, main for rewriting call phrases; outside Russia, Belarus, mainland China and Syria

DeepInfra, Together AI, Baseten, Fireworks AI (DeepSeek model)

• Company: DeepInfra, Together AI, Baseten, Fireworks AI (USA)
• What it does: Host an open model (DeepSeek) where OpenAI and Google models are not available, tried in this order
• Data: The text OpenRouter sends
• Role: Sub-processor, through OpenRouter
• Safeguard: OpenRouter's terms with its providers
• Retention and training: Zero data retention requested with every request
• Use: Backup for chat translation; main for text typed in the translator and voice tests; for people located in Russia, Belarus, mainland China or Syria, or with one of them as profile country

Amazon Web Services (Google Gemma model)

• Company: Amazon Web Services, Inc. (USA)
• What it does: Amazon Bedrock runs Google's open model Gemma, which translates chat messages
• Data: Chat messages to translate with a few earlier messages of the same chat, and voice and video message transcripts to translate
• Role: Processor
• Safeguard: Data Privacy Framework where the provider is certified, otherwise Standard Contractual Clauses in its data processing terms
• Retention and training: AWS states that Amazon Bedrock does not store or log prompts and answers and does not share them with model providers
• Use: Main for chat translation; all countries

6. Email

Cloudflare Email

• Company: Cloudflare, Inc. (USA)
• What it does: Sends our emails, such as sign-in codes, invitations and notices
• Data: The email address and message of each email we send
• Role: Processor
• Safeguard: Data Privacy Framework where the provider is certified, otherwise Standard Contractual Clauses in its data processing terms
• Retention and training: Delivers our emails for us only
• Use: Main; all countries

7. Push notifications

Apple Push Notification service, Firebase Cloud Messaging

• Company: Apple Inc., Google LLC (USA)
• What it does: Push notifications in our mobile apps, once they are available
• Data: Device token, the caller's display name for call alerts
• Role: Processor
• Safeguard: Data Privacy Framework where the provider is certified, otherwise Standard Contractual Clauses in its data processing terms
• Retention and training: Deliver notifications only
• Use: Main for our mobile apps, once they are available

Your browser's push service

• Company: For example Google LLC, Mozilla Corporation or Apple Inc. (USA)
• What it does: Delivers web push notifications to the browser you use
• Data: The push endpoint and the notification, which we encrypt for your browser, so the service cannot read it
• Role: Processor
• Safeguard: We encrypt the content for your browser before it leaves our servers, so the service cannot read it
• Retention and training: Carries content it cannot read
• Use: Chosen by your browser

8. Support

Google Workspace

• Company: Google LLC (USA)
• What it does: Our company email, including the mailbox support@grasp.fm
• Data: What you write to us; your email address and our message when we reply or send an invitation from our mailbox
• Role: Processor
• Safeguard: Data Privacy Framework where the provider is certified, otherwise Standard Contractual Clauses in its data processing terms
• Retention and training: Keeps our mail for us; we keep a conversation up to 3 years after its last message (Privacy Policy, section 8)
• Use: Main; all countries

9. Payments

Stripe and Link

• Company: Stripe, Inc. and its affiliates (USA)
• What it does: Sells Grasp Plus and Grasp Lite on the web as the merchant of record, and handles payment, tax and refunds
• Data: Your email address and an internal account ID when you start a purchase; your payment details, which we never receive
• Role: Independent controller
• Safeguard: Stripe's own safeguards, as a controller under its own privacy policy
• Retention and training: Under its own privacy policy
• Use: Main for web purchases, where paid plans are offered

10. Sign-in

Sign in with Apple, Google sign-in

• Company: Apple Inc., Google LLC (USA)
• What it does: Sign you in with your Apple or Google account, if you choose it
• Data: Your name, email address (or Apple's private relay address) and a stable account identifier
• Role: Independent controller
• Safeguard: Their own safeguards, as controllers under their own privacy policies
• Retention and training: Under their own privacy policies
• Use: Only if you choose it

11. Change log

• 31 October 2026: Calls without translation between contacts can now go directly between devices. Cloudflare relays such a call, through Cloudflare Realtime TURN, when the two devices cannot connect directly or when a person has switched direct connection off in Settings. It carries only the encrypted call audio and sees the two devices' IP addresses.
• 31 October 2026: Deepgram, through LiveKit, now recognizes the speech of voice messages and of the sound of video messages in the languages AssemblyAI does not support, except for people in Russia, Belarus, mainland China and Syria. It no longer serves calls.
• 31 October 2026: Chat messages and the text of voice and video messages are now translated by Google's open model Gemma, run by Amazon Web Services on Amazon Bedrock in the USA, for people in all countries. OpenRouter and the models it reaches are now the backup for chat translation and stay main for text typed in the translator, voice tests and rewriting call phrases.
• 31 October 2026: LiveKit also carries the video of calls when a person turns their camera on. Call video is not recorded or stored and never goes to our speech-processing service or any AI provider.
• 30 October 2026: This page published. The Privacy Policy and the Voice and AI notice now name kinds of providers and point here for each provider.