Compliance
This page lists every third party that processes personal data on behalf of Nimbus. Per Art. 28 GDPR and our Data Processing Agreement, these subprocessors are bound by contractual obligations equivalent to those between Nimbus and you.
Notification of changes: we will update this page at least 30 days before any new subprocessor begins processing personal data, except where prior notice is not legally possible. To receive notifications by email, contact privacy@testnimbus.dev.
| Subprocessor | Role | Data processed | Location | Transfer mechanism | Documents |
|---|---|---|---|---|---|
| Supabase | Authentication, database, edge functions, file storage | Email address, hashed password / OAuth identifier, account metadata, subscription state, team memberships, consent records, license keys (encrypted at rest) | European Union (West EU — Ireland) | EU-based, no transfer outside EEA | DPA · Privacy |
| Stripe Payments Europe, Ltd. | Payment processing, subscription billing, tax calculation, invoicing | Email address, billing address, card last 4 digits, VAT ID (B2B), country, transaction history, invoices | Ireland (EU). Some processing may occur in the United States via Stripe Inc. | EU Standard Contractual Clauses (SCCs) for any US transfer; Stripe is GDPR-compliant. | DPA · Privacy |
| Keygen, Inc. | Software license issuance and validation, machine activation tracking | Email address (license name), Supabase user ID (metadata), machine fingerprint, hostname, OS platform, last heartbeat timestamp | United States | EU Standard Contractual Clauses (SCCs). | DPA · Privacy |
| Fly.io, Inc. | Static website hosting (testnimbus.dev) | IP address, user agent, request logs (no application data — Fly hosts only static files) | European Union (eu-north-1) | EU region only; no application data leaves EU via Fly. | DPA · Privacy |
| Sentry (Functional Software EMEA Ltd.) | Frontend and edge function error monitoring | Stack traces, error codes, page URL, browser metadata (user agent, OS), anonymized IP. No email addresses, user identifiers, or request bodies. | European Union (Frankfurt). Parent company Functional Software, Inc. has US presence; incidental US access by support staff possible. | EU data residency active. EU Standard Contractual Clauses (SCCs) for any incidental US access. | DPA · Privacy |
| Resend, Inc. | Delivery of optional Nimbus product-update emails | Email address, email content, delivery status, and unsubscribe headers for users who explicitly opt in | United States | EU Standard Contractual Clauses (SCCs). | DPA · Privacy |
The following services are used by Nimbus but do not process customer personal data: GitHub (source hosting), Google Cloud (DNS), Cloudflare (CDN/DNS for some assets). These are listed for transparency but are not GDPR Art. 28 subprocessors.
For questions about our data processing, to request a signed Data Processing Agreement, or to object to a subprocessor, contact privacy@testnimbus.dev. See also our Data Processing Agreement and Privacy Policy.