LeapOCR uses third-party subprocessors and service providers to host the product, process documents, run analytics, handle billing, and support website workflows. The list below reflects the current product stack and may change as the service evolves.
| Provider | Purpose | Data involved | Notes |
|---|---|---|---|
| Cloudflare | DNS, CDN, Workers-based upload flow, and R2 object storage. | Uploaded files, temporary objects, request metadata, static-site traffic, and upload-event payloads. | Used for website delivery and OCR ingest/storage flows. |
| Hetzner | Hosted infrastructure for API, workers, application services, and related systems. | Customer content processed by backend services, account metadata, databases, and operational logs. | Primary server and infrastructure hosting layer. |
| Google Gemini | OCR/VLM processing for refinement, bounding boxes, and selected document-processing steps. | Page images, PDF fragments, prompts, instructions, extracted text, and schema context needed for processing. | Used for model steps routed to Gemini. |
| OpenRouter | Model routing and OCR/VLM inference for selected base-model paths. | Page images, prompts, instructions, extracted text, and schema context needed for processing. | Used for model steps routed through OpenRouter. |
| DeepInfra | OpenAI-compatible model inference for selected or fallback OCR/VLM routes. | Page images, prompts, instructions, extracted text, and schema context needed for processing. | Configured in the backend for DeepInfra-backed model routes. |
| Polar | Billing, subscriptions, invoicing, and customer portal flows. | Billing contact details, subscription metadata, invoices, and transaction identifiers. | Used when you purchase or manage paid plans. |
| PostHog | Website and product analytics, feature flags, and event instrumentation. | Page views, event metadata, device/browser information, and attribution data. | Only used where analytics is configured and enabled. |
| Google Analytics | Website analytics and campaign measurement. | Page views, campaign/referrer data, and device/browser metadata. | Only used where analytics is configured and enabled. |
| Cal.com | Scheduling for demo and meeting bookings initiated by users. | Contact and scheduling details you submit when booking a meeting. | Used only if you choose to schedule through our calendar link. |
How to read this list
Not every provider touches every request. Website analytics providers are relevant only to the site or app surfaces where analytics is enabled. Model providers are involved only for workflows routed to those models. Scheduling providers are involved only if you choose to book a call.
Questions
If you need a DPA, security questionnaire, or notification about material subprocessor changes, contact support@leapocr.com.