Nexaloom Ltd ("Nexaloom") uses the third-party sub-processors listed below to deliver the Nexaloom platform. Before engaging any sub-processor, we assess its privacy and security practices and enter into a data processing agreement imposing obligations consistent with UK GDPR Article 28 and our own Data Processing Agreement with customers.
Notification of changes
We will update this page at least 30 days before any new sub-processor begins processing customer personal data, except where a shorter period is necessary to maintain the security or continuity of the Service, in which case we will notify affected customers as soon as reasonably practicable. To receive email notice of changes, subscribe at subprocessor-updates@nexaloom.co. Objection rights and the objection process are set out in our Data Processing Agreement.
Infrastructure sub-processors
These providers process customer personal data as part of the core operation of the platform.
| Sub-processor | Purpose | Data categories | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Neon, Inc. | Primary database hosting (PostgreSQL) | All platform data, including client records, bookings, and consent form data | United Kingdom (AWS eu-west-2, London) | Not applicable — data at rest remains in the UK |
| Vercel, Inc. | Application hosting and serverless functions | Data in transit through the application layer; platform and deployment metadata processed in the US | Compute in UK/EU edge regions with ephemeral caching only; no permanent EU storage; platform data US | EU–US DPF (UK Extension); SCCs with UK IDTA |
| Google Cloud (Google Ireland Ltd) | Storage of uploaded files and photos | Uploaded files, including profile pictures and photos | European Union (Google Cloud europe-west region) | UK adequacy regulations (EEA) |
| Stripe Payments UK Ltd / Stripe, Inc. | Payment processing (Stripe Connect) and subscription billing | Name, email, billing address, payment card data, transaction data | Global (UK/EU/US) | EU–US DPF (UK Extension); SCCs |
| RevenueCat, Inc. | Mobile in-app subscription management | Customer identifiers, subscription status, purchase history | United States | SCCs with UK Addendum (per RevenueCat DPA) |
| Knock Labs, Inc. | Notification orchestration and delivery (email, SMS, push) | Name, email, phone number, device push tokens, notification content | United States (AWS). Knock's own sub-processors are listed at knock.app/legal/subprocessors and include Wildbit LLC (Postmark) for email delivery | SCCs with UK Addendum (per Knock DPA) |
| Telnyx LLC | SMS delivery | Phone numbers, message content | European Union (Telnyx Data Locality — EU at-rest storage) | SCCs (per Telnyx DPA) for any transient non-EU processing or support access |
| Meta Platforms Ireland Ltd (WhatsApp Business Platform) | WhatsApp message delivery | Phone numbers, message content | UK Local Storage region at rest (maximum 30-day retention); transient in-use processing may occur outside the region | WhatsApp Business data processing terms; SCCs |
| Functional Software, Inc. (Sentry) | Application error monitoring | IP addresses, request data, device/browser information, user identifiers associated with errors | European Union (Frankfurt — EU data region) | SCCs with UK Addendum (per Sentry DPA) |
| Better Stack, Inc. (Logtail) | Production log management | User and organisation identifiers, IP addresses, browser user agents | European Union (EU West region) | UK adequacy regulations (EEA); SCCs with UK Addendum where applicable |
| Google LLC (Firebase Cloud Messaging) / Apple Inc. (APNs) | Push notification delivery to Android and iOS devices | Device push tokens, notification content | Global | Google/Apple data processing terms; EU–US DPF (UK Extension) / SCCs |
Customer-enabled integrations
The following services are connected at the choice and instruction of the business using Nexaloom. Data flows to these services only where a business has actively connected its own account. In respect of these transfers, the connecting business acts as controller and the third party under its own terms.
| Service | Purpose | Data categories | Location |
|---|---|---|---|
| Klaviyo, Inc. | Marketing automation for businesses that connect a Klaviyo account | Customer profiles (email, name, phone) and commerce events (carts, checkouts, orders) | United States (AWS us-east-1); transfers under the EU–US DPF (UK Extension) and SCCs. Special category data (including health information from consent forms) is never synced to Klaviyo. |
| Google Calendar (Google LLC) | Two-way booking sync for connected calendars | Booking details (dates, times, services, attendee information) | Global (Google infrastructure) |
| Google Business Profile (Google LLC) | Fetching reviews and posting replies for connected businesses | Review content, business profile information | Global (Google infrastructure) |
| Sign in with Google / Sign in with Apple | Optional authentication | Basic profile data (name, email) received at sign-in | Global (Google/Apple infrastructure) |
Questions
Contact hello@nexaloom.co with questions about our sub-processors or to request copies of our transfer safeguards.