Provider and processing disclosure
Status: This page records providers and data flows verified in the current preview. It is not a data processing agreement, a legally approved subprocessor schedule or a promise about provider contract terms, legal roles, processing regions or retention.
Last updated October 28, 2026. The preview does not currently connect a customer provider account, run a model on submitted content, take payment or send an external message.
Current provider matrix
| Provider | Current function | Data that may be involved | Verified boundary |
|---|---|---|---|
| OpenAI Sites | Public application delivery and Sites project hosting | Ordinary browser and request metadata; application requests and responses | Used to deliver Laborbot.si. Provider operational-log retention, provider contract settings and processing regions have not been independently verified. |
| ChatGPT identity | Authentication for signed-in workspace pages | Platform user ID, email address and, when available, full name in the authenticated request | Laborbot persists the platform user ID and user creation time in its workspace user record; it does not persist the email address or full name in that record. |
| Cloudflare Workers and D1 | Application runtime and durable application records | Early-access and contact submissions; workspace records; tenant, permission, audit, export and deletion records; pseudonymous request-limit data; ordinary request metadata | No R2 file storage is configured. D1 backup retention, restoration behavior, operational-log retention and exact data residency have not been independently verified. |
| HeyGen-hosted media | Optional promotional video on the public home page | Ordinary browser and request metadata when the media is loaded or played | The video uses preload="none". Laborbot does not send signup, contact or workspace records to HeyGen. |
Not connected or enabled
No customer email, calendar, CRM, project, helpdesk, proposal, signature, invoicing, payment or messaging provider is connected. No model provider account, API key, model endpoint, billing processor, advertising analytics service or customer-controlled provider authorization is enabled. A marketing example or planned workflow does not make a provider available.
Contract and legal information still open
- Verified business legal identity, launch markets and applicable controller, processor or subprocessor roles.
- A qualified legal review and approved data processing agreement, customer contract language and legally sufficient subprocessor schedule.
- Selected provider accounts, model provider and endpoints; account-level training, retention and regional-processing settings; and provider-specific contract documents.
- Complete provider subprocessor chains, exact processing regions, operational-log retention and backup retention or deletion evidence.
- A customer notification and objection process for material provider or subprocessor changes, where required.
Because those items are open, this disclosure must not be used as a DPA, contract exhibit or representation that a paid service is legally ready.
Related controls
Read the privacy notice for collection, use, retention and removal boundaries; the integration matrix for unavailable customer providers and actions; the trust boundary for implemented controls; and the preview use rules for the current service limits.