Subprocessor Register
Last updated August 21, 2026
These are the principal providers that may process customer personal data for Ecosystem Navigator. Exact processing location can vary with provider infrastructure, support, resilience, and feature configuration.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Google Cloud Platform and Firebase | Hosting, Firestore database, storage, authentication, application security, and optional analytics | Account, user content, operational and technical data | Canada, United States, and other Google processing locations |
| Google Gemini / Google AI | Question tailoring, report generation, Q&A, synthesis, and document extraction | Prompts, diagnostic context, user content, documents, and generated outputs as required by the feature | United States and other Google processing locations |
| Stripe | Checkout, subscriptions, payment processing, fraud prevention, and billing records | Contact, account, transaction, billing, and payment-method data | United States and other Stripe processing locations |
| Resend | Transactional email, invitations, report delivery, operational notices, and compliant outreach | Recipient and sender details, message content, delivery and engagement events | United States and other Resend processing locations |
| Google Maps Platform | Place search, geocoding, and map display | Place queries, coordinates, and technical request data | Google processing locations |
| Serper | Public web search used to ground local research | Place, organization, topic, and search-query data; personal data is minimized | United States and other provider processing locations |
Changes and objections
We may update this register as providers or features change. For every customer covered by our DPA, we will provide reasonable advance notice before adding or replacing a subprocessor that processes Customer Personal Data. A customer may object on reasonable data-protection grounds during that notice period. We will work in good faith on an alternative, but may suspend the affected feature if no reasonable alternative is available.
Public statistical agencies, government open-data sources, and websites queried for public research are data sources rather than processors under our instructions. Links: Privacy Policy, EU/UK Addendum, and DPA.