Trust Center
Sub-processors
Every provider that processes personal data on our behalf: what it does, what data it handles and where it is.
A small, vetted set of providers helps us run NexPath. Each is bound by a data-processing agreement and processes data only on our instructions. We notify customers of material changes.
List last changed:
- Hetzner OnlineHelsinki, Finland (EU)Hosting & infrastructure
- What it does
- The servers that run NexPath and hold your account and assessment data.
- Data it handles
- All account and assessment data (stored here).
- CloudflareGlobal edge / EU + USNetwork, edge & backup storage
- What it does
- DNS and TLS at the edge; R2 storage holds our encrypted database backups.
- Data it handles
- Traffic passing through the edge; encrypted database backups.
- SupabaseEUAuthentication
- What it does
- Sign-in and social login only.
- Data it handles
- Sign-in identity. No assessment data is stored there.
- OpenRouterUS (routed)Artificial intelligence
- What it does
- Routes requests to the language models that phrase results and power the counselor assistant.
- Data it handles
- Requests contain assessment results (including scores), age and gender where given, and text typed into AI features. Name, email address and username are removed. Routed only to providers that do not collect or train on prompts.
- ResendUSEmail
- What it does
- Sends transactional email: account, consent and notification messages.
- Data it handles
- Names and email addresses, including parents' addresses for consent requests.
- StripeEU / USPayments
- What it does
- Processes payments.
- Data it handles
- Payment-card details, billing address and email. NexPath does not store card numbers.
- SentryEU / USError monitoring
- What it does
- Captures technical errors so we can keep the service reliable.
- Data it handles
- Technical error data, which can incidentally include personal data.
- Better StackEULogging
- What it does
- Aggregates logs off-site.
- Data it handles
- Technical log data, which can incidentally include personal data.
- LoopsUSNewsletter and contact forms
- What it does
- Sends the newsletter and follows up contact-form enquiries.
- Data it handles
- Name, email address and organisation submitted through the newsletter and contact forms.
- Google Analytics / Tag ManagerUS / globalWebsite analytics
- What it does
- Measures how the website is used. Loaded only after you accept analytics cookies.
- Data it handles
- Page-usage events and cookie identifiers, only with analytics consent.
Some sub-processors process limited data outside the EU. Those transfers rely on the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism (Privacy Policy, section 9).
Get notified of changes
We tell customers about material changes to this list. Leave your email address to receive that notice.