Legal document
Subprocessor Register
Last updated29 July 2026
These providers may process Customer Personal Data to operate the Service. A provider is used only for the listed function and only when the relevant feature is configured or used.
Core and feature-dependent providers
| Provider | Purpose and data | Typical processing location / safeguard |
|---|---|---|
| Google Cloud / Firebase | Firebase Authentication, Cloud Firestore and related security infrastructure. Account data, CRM records, encrypted Gmail tokens, AI history and service metadata. | Global Google infrastructure; Firebase Authentication is US-hosted. Google contractual transfer safeguards and applicable UK transfer mechanism. |
| Vercel, Inc. | Application hosting, serverless execution, delivery, operational logs and security. Requests and Customer data processed during Service operation. | United States and global infrastructure; Vercel DPA, SCCs and UK IDTA/Addendum provisions where applicable. |
| OpenAI, L.L.C. / applicable OpenAI contracting entity | Novas Agent and optional reply classification. User prompts, responses and minimum task-relevant CRM context. Responses API requests use store:false. | United States and provider subprocessors; OpenAI DPA and applicable SCC/UK transfer provisions. Default API abuse-monitoring retention may be up to 30 days. |
| Stripe | Subscription checkout, recurring billing, customer portal, payment fraud and financial records. Account name/email, customer and subscription details; Stripe handles payment-card data. | United Kingdom, EEA, United States and global providers. Stripe DPA and transfer safeguards. Stripe also acts as an independent controller for some payment activities. |
| Google APIs / Gmail | Connected-mailbox authorisation, draft creation or approved sending, reply reading and synchronisation. Gmail account, message and thread data. | Google global infrastructure and the account’s selected service region where applicable. Google API Limited Use requirements apply; Google may act as an independent controller for Google account administration. |
| Apple iCloud Mail (optional) | SMTP delivery only if the account operator explicitly configures the optional iCloud delivery provider. Sender/recipient details and message content. | Apple global infrastructure and contractual/privacy terms. Not used when Gmail delivery is selected. |
Changes and objections
The list may change as infrastructure or features change. Material new Subprocessors will be posted here and, where reasonably possible, notified to account contacts before the new processing begins, in accordance with the Data Processing Addendum.
Questions or reasonable data-protection objections can be sent to help@novasagency.com.