Overview
Nephworx Ltd. engages selected third parties (“sub-processors”) to help operate the Service. Each sub-processor processes personal data only to deliver a specific function and is bound by written terms that match the protections in our Data Processing Agreement.
This page is referenced from our DPA and Privacy Policy.
Current sub-processors
The following sub-processors may process personal data as part of the Service:
| Provider | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, storage, CDN, database and transactional email delivery (Amazon SES) | EU (Frankfurt eu-central-1; email: Ireland eu-west-1) | EU: no Article 44 transfer |
| WorkOS, Inc. | Authentication and identity (sign-in / SSO) | United States | EU-U.S. Data Privacy Framework |
| Stripe Payments Europe, Ltd. | Payment processing and subscription billing | Ireland (EU) / United States | EU primary; SCCs for any US fallback |
| PostHog Inc. | Product analytics and feature usage | EU (eu.posthog.com) / United States | EU-U.S. Data Privacy Framework |
| Google Ireland Ltd. (Google Analytics) | Web analytics (visitor metrics) | Ireland (EU) / United States | EU-U.S. Data Privacy Framework |
| Grafana Labs, Inc. (Grafana Cloud) | Performance and error telemetry | EU / United States | Standard Contractual Clauses (SCCs) |
Transfer mechanisms
Where personal data is transferred outside the European Economic Area, we rely on one or both of the following safeguards permitted under Chapter V GDPR:
- EU-U.S. Data Privacy Framework: where the U.S. recipient is self-certified under the Framework, providing an adequate level of protection.
- Standard Contractual Clauses: the latest EU Commission-approved SCCs, supplemented by additional technical measures (encryption, access controls, audit) where appropriate.
Updates and notifications
We update this list when we engage a new sub-processor or change our use of an existing one. The effective date at the top of the page reflects the latest revision.
Customers with an active Subscription can request advance notification of new sub-processors by emailing contact@smetni.app with the subject line “Subscribe: Sub-processor updates”.
Right to object
If you object to a new sub-processor on reasonable data-protection grounds, contact us within 30 days of notification. We will work in good faith to address your concern, which may include offering an alternative configuration or, where this is not possible, allowing termination of the Subscription with a pro-rated refund.
Continued use of the Service after the 30-day period constitutes acceptance of the new sub-processor.