Subprocessors

2.1Supabase#

What it does

Hosts WorkNivo's database, user sign-in, private file storage for Uploaded Documents, live job status, and the server function that sends documents to the AI Provider.

Data

All Customer Content and Account Data; Usage Data; a pseudonymous hash used to rate-limit the website assistant.

Where

Database, sign-in, file storage and backups: eu-west-1 (Ireland). Server functions run in the region closest to the caller, so document processing is likely to run outside the EU. Logs are processed outside the region and stored in the EU, according to Supabase. Supabase support staff may access data from other countries when handling a request. [To be confirmed: processing regions for Netlify functions and the document-processing Edge Function]

Transfers

Standard contractual clauses (Modules 2 and 3) in the Supabase DPA. No Data Privacy Framework listing found.

Terms and security

Supabase DPA · Supabase subprocessors · Data residency and transfers FAQ · Supabase security. [To be confirmed: confirmation that Supabase's data processing terms are in force for WorkNivo's account]

2.2Netlify#

What it does

Hosts worknivo.app and runs the web application server: page rendering, form actions and the website assistant's connection to the AI Provider. Stores early-access form submissions.

Data

All web requests, including sign-in cookies and the Workspace data shown in the app; website-assistant messages in transit; early-access submissions; request logs. Uploaded Documents go directly to Supabase and do not pass through Netlify.

Where

Server functions and stored data: us-east-2 (Ohio, United States). Static files: global content delivery network. [To be confirmed: processing regions for Netlify functions and the document-processing Edge Function]

Transfers

EU-U.S. Data Privacy Framework, according to Netlify's privacy statement; standard contractual clauses in Netlify's DPA for transfers it does not cover. [To be confirmed: Netlify's Data Privacy Framework status is active and its DPA applies to WorkNivo's plan]

Terms and security

Netlify DPA · Netlify privacy statement · Netlify Trust Center (subprocessors and security).

2.3Anthropic (AI Provider)#

What it does

Reads each Uploaded Document and returns structured order information. Also generates the website assistant's answers. See the Privacy Policy and the AI Use & Responsibility Policy.

Contracting entity

Anthropic Ireland, Limited for customers in the EEA, Switzerland and the UK, under Anthropic's terms. [To be confirmed: Anthropic account is under the Commercial Terms, contracting entity, zero-data-retention status and fallback model]

Data

The entire Uploaded Document with fixed instructions. Your customer, product and price records, the user's identity and the Workspace name are not sent. For the website assistant: up to the last 10 messages of the conversation.

Where

Processing may run in any geography (WorkNivo does not set a region); stored data is in the United States. Anthropic offers no EU-only option.

Retention

According to Anthropic's published pages, API inputs and outputs are kept for up to 30 days. If flagged under Anthropic's Usage Policy, inputs and outputs can be kept for up to 2 years and safety classification scores for up to 7 years, or longer where the law requires.

Training

Anthropic's Commercial Terms state that Anthropic may not train models on customer content from its services. This applies to WorkNivo's data only if WorkNivo's account is under those terms, which is being confirmed. Whether a zero-data-retention arrangement is in place is also being confirmed (assumed not). [To be confirmed: Anthropic account is under the Commercial Terms, contracting entity, zero-data-retention status and fallback model]

Transfers

Standard contractual clauses (Modules 2 and 3) in Anthropic's Data Processing Addendum, which is part of its Commercial Terms. No Data Privacy Framework listing found.

Terms and security

Commercial Terms · Data Processing Addendum · Data retention · Trust Center (subprocessors and security).

2.4Resend#

What it does

Sends emails from feedback@worknivo.app to WorkNivo's support inbox when a user sends feedback, a Workspace Owner requests a pilot, or someone sends a data-rights request from Settings. It does not send emails to customers.

Data

The feedback or request message, the sender's email address (and, for data-rights requests, their role and the type of request), the Workspace name and, for feedback, if included, the page address and browser details. Open and click tracking are off.

Where

Sending domain configured in eu-west-1 (Ireland); Resend's DPA states that primary processing is in the United States.

Transfers

Standard contractual clauses and the EU-U.S. Data Privacy Framework, according to Resend's DPA. [To be confirmed: Resend's Data Privacy Framework status is active]

Terms and security

Resend DPA · Resend subprocessors · Resend security.

Account emails such as sign-up confirmation and password reset are sent by Supabase's sign-in service. [To be confirmed: whether Supabase sends account emails through its own mailer or through Resend]

2.5Cloudflare#

What it does

Runs the domain name service for worknivo.app and forwards email sent to @worknivo.app addresses, such as support@worknivo.app, to WorkNivo's inbox. It does not carry traffic to the website.

Data

Emails in transit and their sender and recipient details; domain name lookups.

Where

Global network.

Transfers

EU-U.S. Data Privacy Framework first, standard contractual clauses otherwise, according to Cloudflare's DPA. [To be confirmed: confirmation that Cloudflare's data processing terms are in force for WorkNivo's account]

Terms and security

Cloudflare Customer DPA · Cloudflare subprocessors · Cloudflare Trust Hub.

Cloudflare also protects Supabase's own service and may set a short-lived security cookie when your browser connects to Supabase. That is Supabase's arrangement with Cloudflare, covered by Supabase's subprocessor list.