Sub-processor: Anthropic
Why Anthropic is involved
When the Agreely scanner discovers cookies on your website, a first deterministic pass compares them against a reference list of known cookies. For unknown or ambiguous cookies, Agreely uses the Claude Sonnet 4.6 model (Anthropic) to propose a categorization and bilingual purpose descriptions.
This processing happens once at scan time, outside the real-time consent flow. Anthropic is not involved in:
- Recording consent decisions.
- The hash chain or on-chain anchoring.
- The banner displayed to your site's visitors.
Communication outside Quebec (art. 17)
Anthropic (PBC) is located in the United States. Any data transmitted to Anthropic constitutes a communication of personal information outside Quebec under article 17 of Law 25 (not a "transfer").
Agreely meets article 17 by documenting this communication and disclosing it to customers in this sub-processor note.
What is sent to Anthropic
The model receives only value-free metadata:
- Cookie or storage object name.
- Cookie domain.
- Attributes (expiry,
httpOnly,secure,sameSite, third-party or not). - Third-party hosts co-present during the scan.
- Title and language of the scanned page.
What is never sent:
- The value of the cookie (never stored for the model, never transmitted).
- Visitor personal information.
- Data from the production consent flow.
The absence of cookie values removes the main risk of visitor personal information reaching the LLM request.
Mandatory human review
No categorization produced by the model is published automatically. A member of your team reviews and approves each entry before the first publication. Manually edited entries are permanent: the automated pipeline never touches them again.
The "strictly necessary" determination belongs to a human, not the model.
Written agreement (upcoming)
Agreely is bound by Anthropic's terms of service, which include confidentiality and use-limitation commitments. A formal Data Processing Agreement (DPA) with Anthropic is a commercial launch item, subject to approval by David Tucker (founder). It is not yet in effect at the time of this documentation.
This note documents the honest posture: Anthropic is a sub-processor in the mandatary role (art. 18.3), located outside Quebec, receiving value-free metadata exclusively for the "cookie scanning and categorization" mandate.