Legal
Sub-processors
The third parties that receive data on Nephia’s behalf — who they are, what they see, and where they process it.
Last updated: September 3, 2026
This page lists every third party that processes data for Nephia, what each one receives, and where. It is referenced by our Privacy Policy and forms part of our Data Processing Agreement. It is kept in one place so the documents cannot disagree.
1. Current sub-processors
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| OVH SAS | Hosting: servers, database, queues, backups. | Everything we store, at rest: account data, mentions and their AI labels, embeddings, reports, usage ledger, application logs in transit to the log provider. | France (EU) |
| Cloudflare, Inc. | DNS, content delivery, TLS termination and denial-of-service protection in front of the website, dashboard and API. Turnstile bot check on the sign-in form, when enabled. | Traffic in transit — Cloudflare terminates TLS, so it decrypts and re-encrypts each request — your IP address and request metadata. Nothing at rest beyond short-lived caches and security logs. | Global edge network; US company with EU points of presence |
| OpenRouter, Inc. | AI processing: grouping, sentiment, sorting, summaries, weekly reports, agent steps and semantic embeddings. | The content of mentions (text, titles, public handles) and the instructions you give a Query. Every request is routed only to model hosts that neither train on nor retain the content; OpenRouter itself keeps request metadata for billing. | United States (routing); the model host varies per request and is bound by the same policy |
| Resend, Inc. | Transactional email, and the email delivery channel. | Your email address, sign-in links and account notices. When you route a channel to email, the digests and reports it sends — which contain mentions — and the recipient addresses you configured. | United States |
| Google LLC | Sign in with Google, only when you choose it. | Email address, name, Google account id, profile picture if your account has one. | United States |
| PostHog, Inc. | Product analytics on the website and dashboard, only after you accept analytics cookies. | Page views, feature events and a visitor identifier. No mention content, no email address. Cookieless counting if you decline. | EU (Frankfurt) |
| Better Stack | Application logs and uptime monitoring. | Request metadata, account and Query identifiers, error messages. Kept 3 days. | EU (Frankfurt) |
| Sentry (Functional Software, Inc.) | Error reporting for the API and the worker. | Stack traces, request identifiers and, when an upstream response fails to parse, the fragment that failed. No account email. | EU (Frankfurt) |
| Creem | Payments, as merchant of record, once paid plans open. | Nothing during the public beta: no purchase is possible and Creem is not called. When purchases open: your email, billing identifiers, plan and invoices — stated here before the first sale. | Not active during the beta |
| Source access and network infrastructure providers | Reaching public Sources on our behalf. | The public search terms of a Query and the public content the Source returns. They receive no account data and nothing about you; we do not name them publicly, and provide the named list to a customer on written request under NDA. | Varies; each is bound by a data-processing agreement with us |
Cloudflare Turnstile is active on the sign-in form. It runs a bot check inside its own frame, loaded from challenges.cloudflare.com, and is essential to sign-in; see the Cookie Policy.
2. Changes to this list
- We add a provider to this page before it receives any data.
- Account holders are notified by email of a new sub-processor that will receive mention content or account data. You may object within fourteen (14) days on reasonable data-protection grounds, as set out in the DPA; if we cannot accommodate the objection you may end the Services and export your data first.
- A provider that stops receiving data is removed.
3. Contact
Questions about a provider, or a request for the named Source-access list: [email protected]