Legal
Sub-processors
The third parties that receive data on Nephia’s behalf — who they are, what they see, and where they process it.
Last updated: October 9, 2026
This page lists every third party that processes data for Nephia, what each one receives, and where. It is referenced by our Privacy Policy and forms part of our Data Processing Agreement. It is kept in one place so the documents cannot disagree.
1. Current sub-processors
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| OVH SAS | Hosting: servers, database, queues, backups. | Everything we store, at rest: account data, mentions and their AI labels, embeddings, reports, usage ledger, application logs in transit to the log provider. | France (EU) |
| Cloudflare, Inc. | DNS, content delivery, TLS termination and denial-of-service protection in front of the website, dashboard and API. Turnstile bot check on the sign-in form, when enabled. | Traffic in transit — Cloudflare terminates TLS, so it decrypts and re-encrypts each request — your IP address and request metadata. Nothing at rest beyond short-lived caches and security logs. | Global edge network; US company with EU points of presence |
| OpenRouter, Inc. | AI processing: the AI features described in the Privacy Policy, section 6. | The content of mentions (text, titles, public handles, the public posts around them) and the context you give the AI, such as Keyword instructions, your brand card or a note. Not used for training. Every request is routed only to model hosts that neither train on nor retain the content; OpenRouter itself keeps request metadata for billing. | United States (routing); the model host varies per request and is bound by the same policy |
| Anthropic Ireland, Limited | AI processing: the AI features described in the Privacy Policy, section 6. | The content of mentions (text, titles, public handles, the public posts around them) and the context you give the AI, such as Keyword instructions, your brand card or a note. Not used for training. Deleted within 30 days, kept longer only when flagged for abuse or required by law. | United States and other regions; no EU-only option is offered |
| Resend, Inc. | Transactional email, and the email delivery channel. | Your email address, sign-in links and account notices. When you route a channel to email, the digests and reports it sends — which contain mentions — and the recipient addresses you configured. | United States |
| Google LLC | Sign in with Google, only when you choose it. | Email address, name, Google account id, profile picture if your account has one. | United States |
| PostHog, Inc. | Product analytics on the website and dashboard, only after you accept analytics cookies. | Page views, feature events and a visitor identifier. No mention content, no email address. Cookieless counting if you decline. | EU (Frankfurt) |
| Better Stack | Application logs and uptime monitoring. | Request metadata, account and Keyword identifiers, error messages. Kept 3 days. | EU (Frankfurt) |
| Sentry (Functional Software, Inc.) | Error reporting for the API and the worker. | Stack traces, request identifiers and, when an upstream response fails to parse, the fragment that failed. No account email. | EU (Frankfurt) |
| TinyFish, Inc. | Reading the pages of the website you give us, when you ask for it. Never on a schedule and never as a side effect: one button, one read. | The website address you typed and the public pages it links to. Nothing about your mentions, your Keywords or your account. | Not published by the provider |
| Firecrawl (SideGuide Technologies, Inc.) | Reading the pages of the website you give us, when you ask for it — the alternative provider for the same job. Only one of the two is active on a deployment. | The website address you typed and the public pages it links to. Nothing about your mentions, your Keywords or your account. | United States (Delaware company) |
| Creem | Payments, as merchant of record, once paid plans open. | Nothing during the public beta: no purchase is possible and Creem is not called. When purchases open: your email, billing identifiers, plan and invoices — stated here before the first sale. | Not active during the beta |
| X Corp. | Posting the replies you send from the inbox, only after you connect an X account and click Send. Nothing is posted without that click. | The text of each reply you send, the id of the post it answers, and the access granted by the X account you connected. Reading mentions never goes through this connection. | United States |
| Source access and network infrastructure providers | Reaching public Sources on our behalf. | The public search terms of a Keyword and the public content the Source returns. They receive no account data and nothing about you; we do not name them publicly, and provide the named list to a customer on written request under NDA. | Varies; each is bound by a data-processing agreement with us |
Cloudflare Turnstile is active on the sign-in form. It runs a bot check inside its own frame, loaded from challenges.cloudflare.com, and is essential to sign-in; see the Cookie Policy.
2. Changes to this list
- We add a provider to this page before it receives any data.
- Account holders are notified by email of a new sub-processor that will receive mention content or account data. You may object within fourteen (14) days on reasonable data-protection grounds, as set out in the DPA; if we cannot accommodate the objection you may end the Services and export your data first.
- A provider that stops receiving data is removed.
3. Contact
Questions about a provider, or a request for the named Source-access list: support@nephia.cc