To provide the Service, NexxoSync relies on a deliberately small number of providers. This page lists them, what each one receives and where it processes data. It is part of the Data Processing Agreement.
Every subprocessor is bound by a written contract with confidentiality and data protection obligations no less protective than those in the DPA, and may process data only to perform its function for us. None may use it for its own purposes.
01Infrastructure
| Subprocessor | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| [Hosting provider] | Servers, database, job queue and encrypted backups | All Service data | [Region] | [To complete] |
| [Email provider] | Transactional email: account verification, password reset, service and security notices, alerts, and forwarding contact and withdrawal form messages to our team | Recipient's name and email address, message content | [Region] | [To complete] |
| Cloudflare, Inc. | DNS, content delivery network, reverse proxy, TLS and protection against attacks | All traffic in transit: IP address, request metadata and content | United States and global edge network | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
The hosting and email entries are being completed. Until they are, merchants can ask at [email protected] for the provider's name, region and transfer safeguard.
02Payments
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| PayPal | Subscriptions billed in US dollars | Billing and payment details, entered directly with PayPal | United States and European Union, depending on the customer's region | PayPal's Binding Corporate Rules and Standard Contractual Clauses |
| Mercado Pago | Subscriptions billed in Argentine pesos (Argentina) | Billing and payment details, entered directly with Mercado Pago | Argentina | No international transfer for Argentine customers; Argentina holds an EU adequacy decision |
Card, bank and wallet details never pass through NexxoSync's systems: you enter them with the processor. We receive only the identifier, amount, currency and status of each subscription and payment. For the payment data they collect, PayPal and Mercado Pago act as independent controllers under their own privacy policies; they are listed here for transparency.
03Website analytics
| Subprocessor | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Google (Google Ireland Ltd. / Google LLC) | Google Analytics 4 audience measurement of https://nexxosync.com, only if the visitor accepts it | Browser identifier, pages viewed, referrer, approximate location, device and browser type | United States and other countries where Google operates | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
Google Analytics is used only on the marketing website and only after consent, as described in the Cookie Policy. It is not present in the app or in the chatbot widget, and never receives data about merchants' customers.
04AI providers selected by the Customer
The AI assistants work with the provider each merchant chooses and configures in the app with its own account and credentials. When an assistant answers, NexxoSync sends that provider only the text needed: the conversation, the merchant's instructions and knowledge base, and the catalog or order data relevant to the question. We do not use this data to train models. The supported providers are:
| Provider | Location | Notes |
|---|---|---|
| OpenAI | United States | API platform |
| Anthropic | United States | API platform |
| Google (Gemini) | United States and other Google regions | Gemini API |
| Mistral AI | European Union (France) | API platform |
| Microsoft (Azure OpenAI) | The Azure region the merchant selects | Deployed in the merchant's own Azure subscription |
| OpenRouter | United States | Routes requests to the model provider the merchant chooses, which also receives the text |
| Groq | United States | API platform |
| NVIDIA (NIM) | United States, or wherever the merchant hosts it | Hosted API or self-hosted |
| Ollama | Wherever the merchant hosts it | Self-hosted by the merchant: no third party involved |
Because the merchant chooses the provider, holds the account and accepts its terms, the provider processes this data under the merchant's agreement with it, including any choice about data retention or training that the provider offers. The merchant should select a provider and settings appropriate for its customers and the countries where it sells.
05The platforms the Customer connects are not subprocessors
Mercado Libre, Shopify, WooCommerce, Tiendanube, Odoo and Producteca are not NexxoSync's subprocessors. They are the merchant's own systems, or services the merchant uses, which NexxoSync accesses on the merchant's express instruction and with the authorisation the merchant grants.
Their processing is governed by their own terms and privacy policies, which the merchant accepted when it opened its accounts with them, and by the merchant's agreements with them. The same applies to the hosting of a merchant's WooCommerce store or Odoo instance and to any other plugins or apps the merchant installs.
06Changes to this list
Before adding or replacing a subprocessor that processes personal data, we will update this page and notify merchants by email to the account address at least thirty (30) days in advance.
During that period, a merchant may object on reasonable data protection grounds by writing to [email protected]. If the objection cannot be resolved, the merchant may terminate the affected Service without penalty and receive a refund of prepaid fees for the unused period, as set out in the Data Processing Agreement.
In an emergency — for example, a provider's sudden failure that threatens the Service's continuity or security — we may replace a subprocessor at shorter notice, and will notify merchants as soon as possible, with the same right to object.