Nobsy uses the following authorized sub-processors to operate the Service. We do not sell your personal data for monetary consideration. We disclose personal data and AI Pipeline Data to the service providers, sub-processors, and analytics and advertising partners described below, only as necessary to operate, secure, bill for, analyze, advertise, and improve the Service.
For details on how we handle your data, see our Privacy Policy (Section 6).
| Sub-Processor | Role | Data Location | Data Categories | DPA |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting and application infrastructure, including S3 file storage, RDS PostgreSQL/pgvector database, Lambda compute, SQS job queueing, Cognito authentication, CloudWatch logging, Secrets Manager, and CloudFront content delivery | United States (primarily us-west-1) | Category A & B | AWS DPA |
| OpenAI | Embeddings, summaries, and LLM inference (standard commercial API) | United States | Category B | OpenAI DPA |
| Stripe | Payment processing | United States | Category A (billing) | Stripe DPA |
| Google (GA4 / Google Ads) | Analytics & advertising | United States | Category A (identifiers, network activity) | Google DPA |
| Microsoft (Clarity) | Analytics (heatmaps, session recordings) | United States | Category A (network activity) | Microsoft DPA |
| Cohere | Search result reranking (inference processing) | United States | Category B | Cohere DPA |
| Amazon SES | Transactional email delivery | United States | Category A (email address) | AWS DPA |
| Cloudflare (Turnstile) | Bot detection and abuse prevention | Global (Cloudflare edge network) | Category A (IP address, browser metadata) | Cloudflare DPA |
Sub-Processor Change Notification
We will provide reasonable advance notice before authorizing a new sub-processor that will process Category B data. Customers may object on reasonable data protection grounds within a reasonable period following notification. If we cannot reasonably accommodate the objection, the customer may terminate the affected Service, without penalty, on written notice before the new sub-processor begins processing the relevant data.
Data Categories
Category A (Account & Billing Data): Information required to maintain your account, provide support, and process payments. Includes name, email, IP address, payment history.
Category B (AI Pipeline Data): Data processed through our RAG pipeline. Includes uploaded documents, embeddings, chat session histories, and AI-generated outputs.
Contact
For questions about our sub-processors or data processing practices, contact our Privacy Officer at privacy@nobsy.ai.