NEXAPHAZE LTD engages the third parties below to process personal data on our behalf. Each entry records what the provider is used for, the categories of data it can access, where processing takes place, and whether we hold verified contractual evidence for it.
Current subprocessors
| Provider | Purpose | Data categories | Processing location | Transfer mechanism | DPA |
|---|---|---|---|---|---|
| Supabase | Primary database, authentication and file storage | Account details, uploaded documents, workspace content, usage records | European Union (Frankfurt) | Not yet verified | Not yet verified |
| Vercel | Application hosting, content delivery, and AI request gateway | All data processed in the course of a request, including document content | United States (Northern Virginia); global edge network | Not yet verified | Not yet verified |
| Resend | Transactional email delivery (account, security, billing and support mail) | Email address, message content of transactional notices | European Union (Ireland) for delivery infrastructure | Not yet verified | Not yet verified |
| Stripe | Payment processing, subscriptions and invoicing | Billing name, email, payment metadata. Card numbers are handled by Stripe and never reach us | United States and European Union | Not yet verified | Not yet verified |
| Microsoft 365 (Exchange Online) | Mailboxes receiving support, privacy, legal, billing and security correspondence | Anything you choose to include in an email to us | European Union / United Kingdom, per tenant configuration | Not yet verified | Not yet verified |
| Sentry | Error and performance monitoring | Diagnostic events. Authorization, cookie and CSRF headers are stripped before sending | European Union (Germany) | Not yet verified | Not yet verified |
| PostHogLoaded only after you accept analytics cookies | Product analytics | Pseudonymous usage events | European Union | Not yet verified | Not yet verified |
| Anthropic | AI model provider for assignment analysis and drafting | Prompt and document content submitted to AI features | United States | Not yet verified | Not yet verified |
| OpenAI | AI model provider for assignment analysis and drafting | Prompt and document content submitted to AI features | United States | Not yet verified | Not yet verified |
| Google (Gemini and Google Sign-In) | AI model provider; optional sign-in identity provider | Prompt and document content submitted to AI features; email address and name where you sign in with Google | United States | Not yet verified | Not yet verified |
| Perplexity | AI web research for source discovery | Research queries derived from your assignment brief | United States | Not yet verified | Not yet verified |
| Google Cloud Run (Mindgrads-operated services) | Malware scanning and document thumbnail rendering | Uploaded file contents, transiently during scanning or rendering | European Union (Frankfurt) | Not yet verified | Not yet verified |
| TurnitinOnly where similarity checking is enabled; disabled by default | Similarity checking | Submitted document text | United States | Not yet verified | Not yet verified |
What "not yet verified" means
It means exactly what it says: we have not yet completed and filed our review of that provider’s data processing agreement and transfer mechanism. It does not mean the provider lacks one — most publish standard terms — only that we will not represent a contractual position we have not checked. We would rather publish an incomplete register than an inaccurate one.
Entries are marked verified only once a countersigned agreement has been read and filed. Where a provider is added, this page and its version are updated before the provider begins processing.
Where your data is processed
Account data and uploaded files are stored in the European Union. The application servers that read and write that data run in the United States, so a transfer outside the UK and EEA occurs whenever you use the platform. This is described in section 5 of our Privacy Policy.
Questions and change notice
Data protection enquiries: privacy@mindgrads.com. Legal notices: legal@mindgrads.com.