Sub-processors

1. What sub-processors are

Per GDPR Art. 28, a sub-processor is any third party with whom a processor (NeoFir, acting on your behalf) shares personal data to perform its contractual obligations to you.

For NeoFir, sub-processors are the infrastructure providers (cloud, database, hosting), communications (email, messaging) and payments that make the service possible. Each one has a signed Data Processing Agreement (DPA) with ZYNTHYR OÜ and covers cross-border transfers with GDPR-grade safeguards (SCC, adequacy decision, or no extra-EU transfer at all).

2. Active sub-processor list

As of the last update (July 10, 2026), NeoFir uses the following sub-processors in production:

#	Vendor	Role	Server location	GDPR coverage
1	Supabase Inc.	PostgreSQL database + auth + storage	Frankfurt, EU (eu-central-1)	No extra-EU transfer; DPA
2	Railway Corp.	Backend API hosting (api.neofir.com)	EU West	No extra-EU transfer; DPA
3	Vercel Inc.	Dashboard hosting (app.neofir.com)	Frankfurt, EU (edge)	No extra-EU transfer; DPA
4	Google LLC	Gemini API (LLM) + Google Calendar API	USA (multi-region)	SCC + EU-US Data Privacy Framework (Jul 2023); DPA
5	Resend Inc.	Transactional email (booking confirmations, password resets)	USA	SCC; DPA
6	Stripe Payments Europe Ltd.	Payment processing (subscriptions)	Ireland (primary) + USA (cloud sub-processors)	SCC + EU-US DPF; DPA
7	RoMarg SRL	Widget CDN hosting (cdn.neofir.com) + static landing (neofir.com)	Bucharest, Romania	No extra-EU transfer; hosting contract (intra-EU)
8	Twilio Ireland Ltd.	SMS OTP + WhatsApp Business (BSP) for messages to your end clients	Ireland (primary) + USA (sub-processors)	SCC + EU-US DPF; DPA
9	Meta Platforms Ireland Ltd.	Instagram Graph API + Messenger Platform (webhook + send API for DM messages)	Ireland (primary) + USA (sub-processors)	SCC + EU-US DPF; DPA
10	Functional Software Inc. (Sentry)	Backend error tracking (stack-trace + request metadata) for production observability	USA	SCC; DPA
11	ElevenLabs Inc.	Conversational voice agent (speech-to-text + text-to-speech + call transcripts) for the phone answering service	USA	SCC; DPA

3. Per-vendor details

3.1 Supabase Inc.

• What data goes through: all of your client's data (organization data, bookings, chat conversations, RAG documents, user accounts).
• Why: Supabase runs PostgreSQL + pgvector + Auth + Storage — the spine of the NeoFir stack.
• How it's protected: per-project isolated database, RLS (Row-Level Security) applied on all tenant tables, secrets encrypted at the column level (AES-GCM).
• Supabase downstream sub-processors: AWS (Frankfurt, eu-central-1) as infrastructure provider.

3.2 Railway Corp.

• What data goes through: transient — request/response API, application logs. No data persisted at the container layer.
• Why: Railway hosts the Node.js Fastify service (api.neofir.com).
• How it's protected: TLS in transit, runtime secrets injected via encrypted environment variables, logs rotated at 7 days.
• Railway downstream sub-processors: Google Cloud (europe-west) as infrastructure provider.

3.3 Vercel Inc.

• What data goes through: request/response dashboard (Next.js SSR), Supabase Auth session cookies.
• Why: Vercel hosts app.neofir.com (React/Next.js 16 dashboard).
• How it's protected: TLS, EU-only edge routing enforced, 24h log retention.

3.4 Google LLC

• What data goes through: (a) to Gemini API — end-user message content + your organization's relevant knowledge base (top-k RAG chunks), for inference only; (b) to Google Calendar API — booking data (title, duration, client email, phone).
• Why: Gemini 2.5 Flash is the LLM generating widget answers. Calendar API syncs bookings into your calendar.
• How it's protected: Gemini is accessed via the paid API tier, whose terms exclude the use of submitted content to train Google's models; per-org OAuth for Calendar (tokens encrypted at rest in Supabase with AES-GCM, never logged).
• Note on US transfer: Google is enrolled under the EU-US Data Privacy Framework (EC adequacy decision, July 2023). Additional SCC clauses cover gaps.

3.5 Resend Inc.

• What data goes through: recipient email address, name, transactional email content.
• Why: Resend sends booking confirmations, 24h reminders and password reset emails.
• How it's protected: DKIM + SPF + DMARC on send.neofir.com, 30-day email retention at Resend, no tracking pixel.

3.6 Stripe Payments Europe Ltd.

• What data goes through: email address, name, amount, currency, subscription ID. Card data NEVER touches NeoFir servers — it is handled exclusively by Stripe Checkout (PCI-DSS Level 1).
• Why: Stripe processes subscription payments (when public billing is enabled).
• How it's protected: Stripe Checkout iframe (client-side tokenization), HMAC-signed webhooks, idempotency keys on write operations.

3.7 RoMarg SRL

• What data goes through: no personal data — RoMarg only hosts static files (HTML/CSS/JS widget bundle + landing) and the primary email server (zynthyr.com, neofir.com).
• Why: low-latency widget CDN inside the EU + email forwarder + FTP hosting for neofir.com.
• How it's protected: cPanel firewall, Let's Encrypt SSL auto-renewed, server logs kept 30 days.

3.8 Twilio Ireland Ltd.

• What data goes through: the E.164 phone number of the recipient (end-user receiving an OTP at sign-in, or end client receiving a WhatsApp Business message), plus the SMS / WhatsApp message body.
• Why: Twilio delivers authentication SMS (OTP) for account owners and acts as our BSP (Business Solution Provider) for WhatsApp Business until we scale to the Cloud API directly.
• How it's protected: API token-based auth with rotation, 30-day message content retention at Twilio, HMAC-signed inbound webhooks.
• Note on US transfer: Twilio Ireland is the primary entity for EU customers; cloud sub-processors (AWS) covered by SCC + EU-US DPF.

3.9 Meta Platforms Ireland Ltd.

• What data goes through: the Instagram / Facebook ID of the user DMing you, the message body, the connected business page / account IDs, and the Page Access Token (encrypted at rest in Supabase).
• Why: Meta delivers Instagram + Messenger DM webhooks to NeoFir and exposes the Send API for replies.
• How it's protected: HMAC-SHA256 signature with the App Secret on every inbound webhook, Page Access Tokens encrypted with AES-GCM at rest, minimum-necessary OAuth scopes (instagram_business_messaging + pages_messaging).
• Note on US transfer: Meta Ireland is the primary entity for EU customers; trans-Atlantic transfers covered by the EU-US DPF (re-listing July 2023).

3.10 Functional Software Inc. (Sentry)

• What data goes through: stack-trace of unexpected errors (5xx), request metadata (method, URL, request-id, organization-id as tag). NOT the request body content — explicitly filtered out via beforeSend to avoid client PII.
• Why: Production observability — without error tracking, a 3 AM functional regression stays invisible until a customer reports it.
• How it's protected: DSN secret stored in Railway env, 10% trace sampling, 30-day error retention on the free plan, server-side scrubber on sensitive fields (phone, email, Authorization headers).
• Note on US transfer: Sentry's primary servers are in the US, covered by SCC. EU-region self-hosting evaluated post-pilot.

3.11 ElevenLabs Inc.

• What data goes through: live call audio (caller's voice), the resulting transcript, and the caller's phone number — only for businesses that enable the phone answering service.
• Why: ElevenLabs provides the conversational voice agent (speech-to-text, LLM orchestration, text-to-speech) that answers your phone calls.
• How it's protected: HMAC-signed post-call webhooks, per-org agent isolation, transcripts stored in our EU database under the same retention rules as chat conversations.
• Note on US transfer: ElevenLabs is US-based; transfers covered by SCC under their DPA.

4. Change notification

We notify you by email at least 30 days in advance before adding, replacing or removing a sub-processor. The notification includes:

• The new sub-processor's name and registered office
• The categories of data shared and the purpose
• Server location and GDPR coverage
• Link to their public DPA

The very page you're reading is updated in parallel and prior versions are archived (see the version history below).

5. Right to object

You can object to a new sub-processor by emailing hello@neofir.com within the 30 days following the notification.

If your objection makes it impossible to deliver the service as-is (e.g.: we can't operate without a database), we will help you export your full data set and cancel the account with no penalties, with pro-rata refund of the subscription.

6. Version history

Version	Date	Change
1.2	July 10, 2026	Added ElevenLabs (voice agent for the phone answering service) — 11 active sub-processors total. Clarified Gemini training-exclusion wording (paid API tier terms).
1.1	May 24, 2026	Added Twilio (SMS OTP + WhatsApp BSP), Meta Platforms (Instagram DM + Messenger), Sentry (error tracking) — 10 active sub-processors total.
1.0	May 23, 2026	Initial version published as a dedicated page. Mirrors the list from Privacy Policy §5.

7. Contact

← Back to home  ·  Privacy Policy  ·  Terms of Service