Legal › Privacy
Subprocessors
The companies that help us run Nvivio, what each one does, where the data is and with which safeguard. We announce every change at least 30 days in advance.
In short. Three companies process the data of your visitors for us: Cloudflare, Supabase and, once “Ask Nvivio” is switched on, Amazon Web Services. All of them store it in the EU. For our own administration we add Mollie and Billit, which never see the data of your visitors.
Subprocessors for the data of your visitors
These companies process personal data of your visitors on our behalf, under the Data Processing Agreement. Each one is bound by a data processing agreement with obligations at least as strict as ours.
| Subprocessor | What it does for Nvivio | Data | Where the data is | Safeguard |
|---|---|---|---|---|
| Cloudflare, Inc., USA | Network and protection against attacks; delivers the script (nviv.io) and receives events; runs our code (Workers); the queue of events (Queues) and the configuration of sites (KV); connection to the database without caching (Hyperdrive); sends the emails of Nvivio (Email Service) | Everything the script sends; the IP address in memory only | Storage under EU jurisdiction; the dashboard and API run in Frankfurt; a request first arrives at the data centre closest to the visitor | EU-US Data Privacy Framework and the standard contractual clauses |
| Supabase, Inc., USA, on Amazon Web Services | The database (Postgres) with visits, events and daily totals, and sign-in | Everything that is stored, without IP addresses | Frankfurt, Germany (AWS eu-central-1) | Standard contractual clauses |
| Amazon Web Services EMEA SARL, Luxembourg | The language model behind “Ask Nvivio” (Amazon Bedrock). It receives your question and the figures of one site that the answer needs; never IP addresses, cookies or email addresses. The model’s maker receives nothing. | The question and figures for one site | Frankfurt, Germany (eu-central-1) | EU company, EU region |
Status. Cloudflare and Supabase are in use. Amazon Web Services is announced and will be used once “Ask Nvivio” is switched on; until then no data goes to it.
Service providers for our own administration
These companies process data of our customers (not of your visitors) for our own administration, with us as the controller. They are not subprocessors under the Data Processing Agreement, but we list them so you know who receives what. See the Privacy Policy.
| Provider | What for | Data | Where |
|---|---|---|---|
| Cloudflare, Inc., USA | Our website, receiving email at support@ and team@ (Email Routing), attachments of those emails (R2, EU jurisdiction), and access to our administration (Cloudflare Access) | Website requests, your emails to us | EU storage |
| Supabase, Inc., USA | Accounts and sign-in, including the emails with a login link | Email address, login times | Frankfurt, Germany |
| Mollie B.V., Amsterdam, the Netherlands | Payments, once paid plans are available | Name, payment details, amounts | EU |
| Billit, Belgium | Invoices and sending them through Peppol, once we switch to it | Company details, invoices | EU |
Not our subprocessors
Services you choose and connect yourself are not on this list: an AI assistant connected through the MCP server (its maker receives what it reads, under its own terms), a tool that reads the API with your key, your cookie banner, or anyone you share a dashboard or a report with.
Changes
We tell the owners of every organisation by email at least 30 days before we add or replace a subprocessor, and add the change below. You may object as described in article 6 of the Data Processing Agreement.
- 25 October 2026: first published. Cloudflare and Supabase in use; Amazon Web Services announced for “Ask Nvivio”; Mollie and Billit announced for our own administration.