Sub-processors
The third parties that may process personal data on behalf of Nexus, or that receive data because you connected them. This page is the authoritative list referenced by our Privacy Policy and our data processing agreement.
Effective July 28, 2026 · Last updated July 28, 2026
Registration details pending. The registered company number and office address for Nexus Bots B.V. are being finalised and will be published here. Until then, reach us at the contact addresses below.
Current sub-processors
| Recipient | Purpose | Data involved | Role |
|---|---|---|---|
| Vercel | Application hosting, edge network, and request logs for the web app | Request metadata, IP address, account identifiers | Processor |
| Fly.io | Hosting for the durable execution worker | Queued job payloads, bot message content in transit | Processor |
| Managed PostgreSQL provider | Primary database for all account, workspace, and bot data | All stored account, flow, conversation, and billing records | Processor |
| S3-compatible object storage | Media uploaded to, or generated by, bot flows | Images and files, with derived object keys | Processor |
| Stripe | Subscription billing, tax calculation, and marketplace payouts | Billing contact, payment references, payout and tax details | Independent controller and processor |
| Resend | Transactional email (verification, password reset, alerts) | Email address, message content | Processor |
| OpenAI (flow generator) | Generating and modifying flows in the builder, on our own OpenAI account, and evaluating how well that feature works | The prompt you write, the flow you submit for modification, and the generated result | Processor |
| OpenAI, Anthropic, or Google (AI nodes at run time) | Running an AI node inside a deployed flow, using the API key from a connection you configured | Prompt text and the conversation context your flow passes in | At your direction |
| Google (Sheets, Calendar, Gmail, YouTube) | The Google integrations you explicitly connect | The spreadsheet, calendar, message, or live-chat data covered by the scopes you granted | At your direction |
| Meta (WhatsApp, Messenger, Instagram) | Delivering and receiving messages on channels you connect | Message content, platform user IDs, delivery receipts | At your direction |
| Telegram, Discord, Slack, Twitch | Delivering and receiving messages on channels you connect | Message content, platform user IDs | At your direction |
| Twilio | SMS and voice channels you connect | Phone numbers, message and call content | At your direction |
| HubSpot | CRM integration you connect | Contact records your flow reads or writes | At your direction |
What the roles mean
- Processor — handles data only on our documented instructions, under a written agreement containing the data protection terms required by Article 28 of the EU GDPR (and the UK GDPR where it applies), including confidentiality obligations and security measures.
- Independent controller and processor — acts as our processor for some activities and decides its own purposes for others. Stripe, for example, processes payments on our instruction but is an independent controller for fraud prevention and its own regulatory obligations.
- At your direction — receives data only because you connected that service or built a flow that calls it. We are not choosing the recipient on your behalf, and your relationship with that provider is governed by its own terms.
Several of these providers operate outside the EEA. Transfers are covered by the safeguards described in section 10 of our Privacy Policy.
Notice of changes
We update this page when we add or replace a sub-processor. If you have a data processing agreement with us and want advance notice of changes so that you can object, email privacy@hmcelik.com and we will add you to the notification list.