Every hop your data takes.

Chat flow (user prompt → model response)

• 1. Browser → Vercel edge: Your prompt travels over HTTPS (TLS 1.2+) to the nearest Vercel edge node. IP address is logged transiently (~24h) for abuse detection; content is not stored at the edge.
• 2. Vercel edge → LADLE origin (Vercel serverless function): Request is authenticated against your session token. Function runtime lives in us-east-1.
• 3. LADLE origin → Supabase: A new message record is created in the database. Row-level security enforces that this record is only readable by your account (or a workspace admin for team accounts).
• 4. LADLE origin → Anthropic API: Your prompt is sent to Anthropic's Claude endpoint (Haiku or Sonnet — see /models). Anthropic processes the prompt, generates a response, and returns it token-by-token via Server-Sent Events. Under Anthropic's commercial API terms your prompt is never used for model training; those terms do permit a limited abuse-monitoring retention window, and we have not yet signed a zero-data-retention addendum.
• 5. LADLE origin → Browser: Streaming response returned as SSE. Each token is also appended to the Supabase message record.
• 6. Final state: The chat is stored in Supabase. Only you (and, on a team account, your admins via explicit export request) can read it.

File upload flow

• 1. Browser uploads file via authenticated HTTPS POST to Vercel origin.
• 2. File is deduplicated by content hash and stored in Supabase Storage (backed by AWS S3, us-east-1). Access-controlled to your account only.
• 3. When you send a message that references the file, the file's content is included in the prompt sent to Anthropic (subject to file-type support — see /docs/file-types-and-limits).
• 4. File persists in Supabase Storage until you delete the chat (or, for project files, delete the project). Deletion cascades within 30 seconds; backup copies removed within 24 hours.

Billing flow (subscription charge)

• 1. On subscribe or renewal, your card is charged by Stripe (PCI DSS Level 1). Card data never touches LADLE infrastructure.
• 2. Stripe returns a tokenized reference + last-four; only these are stored by LADLE.
• 3. LADLE's billing engine earmarks the $8 (or plan-appropriate portion) into the LADLE meal fund.
• 4. On the last day of the month, LADLE aggregates all earmarked amounts and publishes a monthly fund report on /impact/reports with the reserved-meal count.
• 5. Once the LADLE meal fund clears the $50,000/year partnership threshold, aggregated fund transfers ship as real donations (a payment leaves LADLE's bank; no customer identity is ever transmitted). partner reference numbers publish alongside from that point on.

Never-happens flows

• Chat content is never shared with third-party analytics, ad networks, or LLM training pipelines.
• Your data is never shared with a hunger-relief charity of your choice. If and when the $50k/year threshold clears and real transfers begin, only an anonymous aggregate donation amount is transmitted.
• Personal data is never sold, rented, or shared with data brokers (see /legal/privacy-choices).
• Support staff do not browse chats unless you explicitly grant access for a specific support case.

Regions

SEE /LEGAL/SUBPROCESSORS FOR EACH VENDOR'S DPA · SEE /LEGAL/DPA FOR OURS