Nexxtool AILegal
Subprocessors
These are the companies that process personal data for us to provide Nexxtool AI. We update this page before adding or replacing one. Business customers who want advance notice can email support@nexxtool.ai to be notified.
| Provider | Purpose | Data | Location | Privacy policy |
|---|---|---|---|---|
| Supabase | Database, sign-in (accounts, sessions) and storage for your account, rules, history and logs | Email, password hash, rule sets, API key hashes, check history (60-character preview and fingerprint), usage, consent record, logs | [OWNER: Supabase project region] | Link |
| Railway | Hosts the Nexxtool AI API and application server | All API traffic passes through it, including the reply text you send for a check (processed in memory, not stored in full); request logs with IP address | [OWNER: Railway region] | Link |
| Vercel | Hosts the website and routes requests to our API (edge network) | IP address and request details of every visit; request content in transit | Global edge network; company based in the United States | Link |
| Stripe | Payments, subscriptions, invoices, receipts, customer billing portal | Name and card data you enter at Stripe, billing email, Stripe customer ID, plan, payment history | United States and other countries | Link |
| Resend | Sends our emails (verification, reset, welcome, usage, billing and account notices) | Your email address and the content of each email | United States | Link |
| GitHub | Stores our encrypted nightly database backups for 30 days (private repository) | An encrypted copy of the database; it is encrypted before upload, so GitHub cannot read it | United States | Link |
| jsDelivr (content delivery network) | Delivers the sign-in client library (Supabase JavaScript) to the sign-in and dashboard pages | Your IP address and browser details when the page loads | Global CDN | Link |
| PostHog (US cloud) | Website analytics: page views, referrers and campaign tags, and five product events (sign-up started, sign-up completed, first check run, upgrade clicked, checkout completed). Not loaded on admin or connector pages. No session recording | Page address without fragment or non-campaign query parameters, referrer, device, browser and operating system, approximate location from IP address, an anonymous visitor ID, and for signed-in users an opaque account ID. Never email, name, password, API keys, reply text or rule text | United States | Link |
| Microsoft Clarity | Website heat maps and page-use statistics on our public pages only (not the sign-in pages, the dashboard, admin or connector pages) | Page address, clicks, scrolling, device, browser and approximate location from IP address, an anonymous visitor ID. Text typed into forms is masked. Never loaded when your browser sends Do Not Track or Global Privacy Control | United States | Link |
| Sentry (only if enabled) | Error monitoring for the API server | Technical error details; no reply text is sent on purpose. [OWNER: confirm whether Sentry is switched on in production (SENTRY_DSN_BACKEND); delete this row if it is not] | United States | Link |
| Ollama Cloud (AI model provider for knowledge checks) | Compares a reply with your facts when you use knowledge checks on our AI. If you add your own OpenAI, Anthropic or Google Gemini key, your text goes to that provider on your instruction instead | The reply text and the relevant fact statements for each knowledge check | [OWNER: provider and region, once chosen] | Link |
PostHog and Microsoft Clarity are the only analytics providers; no advertising or cross-site tracking provider is used. For how long we keep data, see the Privacy Policy. For the contract terms with business customers, see the Data Processing Addendum.