Subprocessors

Third-party service providers that process data on behalf of NivoaFlow.

Last Updated: September 28, 2026

NivoaFlow uses the following subprocessors to deliver our services. Each subprocessor is bound by contractual obligations to protect your data and maintain security standards comparable to our own commitments under PIPEDA.

Supabase

United States (AWS us-west-2)

Database hosting, authentication, and backend services

Data shared: Account data, user preferences, financial records
View Privacy Policy

Plaid

United States

Bank account connectivity and transaction aggregation

Data shared: Bank account identifiers, transaction history, account balances
View Privacy Policy

Stripe

United States (with data processing in user's region)

Payment processing

Data shared: Payment card details, billing information
View Privacy Policy

RevenueCat

United States

Mobile subscription purchase validation and entitlement management

Data shared: App user ID, store purchase identifiers, subscription status, and basic device/store metadata (no bank transactions, account balances, or card details)
View Privacy Policy

Google (Sign in with Google)

United States

Optional sign-in with a Google account

Data shared: Name, email address and a unique account identifier, shared by Google when you choose Sign in with Google (we never receive your Google password)
View Privacy Policy

Apple (Sign in with Apple)

United States

Optional sign-in with an Apple ID on iPhone

Data shared: Name, email address (which may be an Apple private relay address) and a unique account identifier, shared by Apple when you choose Sign in with Apple (we never receive your Apple password)
View Privacy Policy

Cloudflare

Global (edge locations)

Content delivery, DDoS protection, and edge hosting

Data shared: IP addresses, request metadata (no financial data)
View Privacy Policy

Resend

United States

Transactional email delivery

Data shared: Email addresses, email content for delivery
View Privacy Policy

Google Cloud Platform

Canada (northamerica-northeast1) and United States

API hosting and compute services

Data shared: API request/response data, logs
View Privacy Policy

PostHog

United States

Product analytics (feature usage, signup and onboarding funnels)

Data shared: Pseudonymous usage events and user identifiers (no financial data, no form contents; text and inputs are masked, session recording disabled)
View Privacy Policy

Sentry (Functional Software, Inc.)

United States

Crash and error reports from the web app and mobile app

Data shared: Error details and code location, screen or page, browser or device model and operating system, app version, and timing for a sample of requests (not tagged with your name, email address or account; no financial data)
View Privacy Policy

Tidio

European Union and United States

Customer support chat and automated support assistant

Data shared: Chat message contents, visitor identifier, IP address, browser/device information, and any name or email address you provide in chat (no account or financial data is sent automatically)
View Privacy Policy

Telegram

Global (Telegram data centres)

Real-time visit alerts to NivoaFlow staff about activity on our public website

Data shared: Pages viewed on nivoaflow.com and on the app's signed-out pages (sign-up, sign-in, password reset, /try) and when, referring site and campaign tags, approximate city, internet provider name, browser and device type, a daily visitor code, first and most recent visit dates, and a note that an account was created with its sign-up method (no name, email address, IP address, cookies, account or financial data)
View Privacy Policy

Microsoft (Clarity)

United States

Marketing website analytics: heatmaps and session replay to understand how visitors use nivoaflow.com (loads only with your consent)

Data shared: Page interactions, clicks, scrolling and mouse movement on the marketing site, IP address, and browser/device information (text input is masked; Clarity does not run inside the NivoaFlow app, so no account or financial data is recorded)
View Privacy Policy

Meta Platforms (Meta Pixel)

United States

Advertising measurement and campaign attribution (loads only with your consent)

Data shared: Page view and sign-up completion events, IP address, browser/device information, and cookie identifiers (no financial data, no account balances, no transaction data)
View Privacy Policy

Changes to This List

We may update this list as our service providers change. Material changes will be noted in our Privacy Policy change log. For questions about our subprocessors, contact privacy@nivoaflow.com.