Vendor record · huggingface.co
What Hugging Face promises about your data.
Where Hugging Face publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
Hugging Face lists its sub-processors at cdn-media.huggingface.co/landing/assets/Subprocessors.pdf. We last read it on October 15, 2026.
- What has changed
We've read its sub-processor list and data processing agreement since October 1, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
When it adds a sub-processor, its clause at cdn-media.huggingface.co/landing/assets/Data+Processing+Agreement.pdf (read October 1, 2026) gives you 30 days to object.
- Window
- 30
- Sub-processors
- 2
- Pages
- 7
- Copies
- 82
days to object when it adds a sub-processor
sub-processors named
pages we watch
dated copies of all its pages, since August 31, 2026
Hugging Face DPA
Hugging Face's data processing agreement gives 30 days to object to a new sub-processor. Here is the clause, from our October 1, 2026 copy:
30
days to object
“6.3 When Provider engages any new Subprocessor after the effective date of the Agreement, Provider will update the Subprocessors List. If Customer objects to such engagement in a written notice to Provider within 30 days after the publication of the updated list on reasonable grounds relating to the protection of Personal Data, Customer and Provider will work together in good faith to find a mutually acceptable resolution to address such objection.”
Found automatically and not yet checked by a person. The quote is exact, and the link goes to the source. Nothing here says whether the term is good or bad, only that Hugging Face published it.
cdn-media.huggingface.co/landing/assets/Data+Processing+Agreement.pdf · read 2026-10-01 · fingerprint 64b320ced7db6d42…
Hugging Face sub-processors
Hugging Face publishes a sub-processor list at cdn-media.huggingface.co/landing/assets/Subprocessors.pdf; we last read it on October 15, 2026. It names 2 entries. The entries, as the list prints them: Amazon Web Services, Inc.; Hugging Face, Corp.. The same list is in the full table below. The public record holds no change to the list read before September 15, 2026. A change we read after September 15, 2026 is published 30 days after we read it.
2 named · full table
Every public change we have recorded · Where vendors publish their lists
How long Hugging Face keeps your data
We hold no statement about data retention from Hugging Face's watched pages. The pages we watch: changelog huggingface.co/changelog; data processing agreement cdn-media.huggingface.co/landing/assets/Data+Processing+Agreement.pdf; pricing page huggingface.co/pricing; privacy policy huggingface.co/privacy; status page huggingface.co/status; sub-processor list cdn-media.huggingface.co/landing/assets/Subprocessors.pdf; terms of service huggingface.co/terms-of-service. On training with customer data, Hugging Face's privacy policy (huggingface.co/privacy, in the copy read August 31, 2026) says: “Similarly, we reserve the right to disclose your information without your consent for the purpose of protecting against harm to the rights, property or safety of the Company, our Users, yourself or the public. #### E. For legal or regulatory purposes We also reserve the right to disclose your information without your consent to comply with any applicable l…”
Training on customer data
“Hugging Face private Hub: where you can build, benchmark, share, version and deploy Models, Datasets and Machine Learning Applications, that are only accessible by You or your Organization(s) - Inference Providers Service: where you or your organization(s) can run inference via application programming interface on machine learning models publicly or privately hosted on our Model Hub - **A…”
huggingface.co/terms-of-service · read 2026-09-02
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Sub-processors named · 2 · 1 name an AI provider we list
Amazon Web Services, Inc.
Hosting/Infrastructure
United States
Hugging Face, Corp.AI · Hugging Face
Data location · United States
“LOCATION OF PROCESSING AND DATA TRANSFERS The Company and its servers are located in the United States.”
huggingface.co/privacy · read 2026-08-31
The pages' own stamps: Effective Date 2023-03-28 · Effective Date 2022-09-15 · Last Updated 2025-01-23
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
Data processing agreement
cdn-media.huggingface.co/landing/assets/Data+Processing+Agreement.pdf2026-10-15
Where we get nothing
What Hugging Face does not publish where we can read it
Of the 7 public pages we watch for Hugging Face, these give us nothing right now.
Model or system card
the page at that URL is not that document
huggingface.co/modelsTrust and security
the page at that URL is not that document
huggingface.co/trustBefore you conclude anything
This only means we couldn’t read it on a public page. Hugging Face may share it in its agreement, a trust portal, or with any customer who asks.
So treat it as a question to ask them: “Can you send your sub-processor list, and tell us when it changes?”
What this page doesn’t tell you
No score.
Nothing here rates Hugging Face. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at Hugging Face? With an email at huggingface.co you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is Hugging Face in your product? Hear the morning we read a change.
You get the lines that moved, in Hugging Face’s own words, and the date any window closes. No card. Nothing to cancel.