Jump to section
01
Overview
NebulaHex Pvt Ltd engages a small set of third-party service providers (“subprocessors”) to deliver the Service. Each subprocessor processes a defined category of data for a specific purpose under contract.
This list distinguishes core subprocessors (engaged for every workspace) from conditional subprocessors (engaged only when a customer connects a specific integration or channel). The list is reviewed quarterly and updated whenever a subprocessor changes.
02
Core Subprocessors
| Entity | Purpose | Data Categories | Region |
|---|---|---|---|
| Clerk, Inc. | Authentication and identity management | Account credentials, session tokens, user profile | United States |
| Supabase Inc. | Primary database (Postgres + pgvector), object storage | All workspace data including bots, conversations, knowledge sources, audit logs | ap-south-1 (Mumbai) |
| Anthropic, PBC | Large language model inference (Claude) | Conversation content (prompts and responses) | United States |
| OpenAI, L.L.C. | Text embeddings and fallback inference | Knowledge text (input → vector embeddings) | United States |
| Resend, Inc. | Transactional email delivery | Recipient email addresses, message bodies | United States and European Union |
| Upstash, Inc. | Redis-backed rate limiting and ephemeral caching | Rate-limit counters, short-lived cache values | ap-south-1 (Mumbai) |
| Paddle.com Market Limited | Billing and Merchant of Record | Customer billing information, payment method tokens | European Union |
| Vercel, Inc. | Application hosting and edge network | All application traffic | Global edge network |
| Firecrawl (Mendable Inc.) | URL ingestion for knowledge sources | Public webpage URLs and content customers add to bot knowledge | United States |
| Supadata | YouTube transcript extraction | YouTube video URLs and IDs customers add to knowledge sources | United States |
Each core subprocessor above is engaged under a contract that includes data protection obligations equivalent to or stronger than ours. Specifically, subprocessors processing EU/UK personal data are bound by Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms.
Subprocessors’ own attestations (SOC 2, ISO 27001, etc.) are published on their respective trust/compliance pages. We do not reproduce those attestations here.
03
Conditional Subprocessors
The following subprocessors are engaged only when a customer connects a specific integration or channel. Data flows to these providers are initiated by the customer’s explicit configuration; we do not transmit data to them by default.
| Entity | Engagement trigger | Data flowing | Region |
|---|---|---|---|
| Google LLC (Workspace API) | Customer connects Google Sheets connector | Read-only access to authorized spreadsheets | Per customer's Google data region |
| Meta Platforms, Inc. | Customer connects WhatsApp, Instagram, or Messenger channel | Message content, sender handles, timestamps, attached media | Per Meta's regional infrastructure |
| Slack Technologies, LLC | Customer connects Slack integration | Workspace metadata, channel data per scope granted | United States |
| Salesforce.com, Inc. | Customer connects Salesforce integration | CRM records per scope granted | Per customer's Salesforce instance region |
| HubSpot, Inc. | Customer connects HubSpot integration | Contact and CRM data per scope granted | Per customer's HubSpot portal region |
| Zendesk, Inc. | Customer connects Zendesk integration | Ticket and customer data per scope granted | Per customer's Zendesk subdomain region |
| Freshworks, Inc. (Freshdesk) | Customer connects Freshdesk integration | Ticket and customer data per scope granted | Per customer's Freshdesk subdomain region |
| Zoho Corporation | Customer connects Zoho CRM or Zoho Desk integration | CRM/Desk records per scope granted | Per customer's Zoho data center |
| Intercom Inc. | Customer connects Intercom integration | Conversation and contact data per scope granted | Per customer's Intercom workspace region |
| Shopify Inc. | Customer connects Shopify integration | Store, order, and customer data per scope granted | Per customer's Shopify store region |
| Telegram Messenger LLP | Customer connects Telegram channel | Message content, chat IDs | Telegram's infrastructure |
When a customer disconnects a conditional integration or channel, data flow to that subprocessor stops immediately. Data previously received and stored in our database is retained per our standard retention policy (Privacy Policy §10).
04
Notification of Changes
We update this list within 30 days when:
- A new subprocessor is added.
- An existing subprocessor's role materially changes.
- An existing subprocessor is removed.
Workspace Owners are notified of material changes via email at least 30 days before the change takes effect, where practicable. For urgent operational changes (provider migrations driven by reliability or security), we may make changes faster and notify retroactively, in which case the notification will explain the urgency.
Enterprise customers with executed DPAs receive change notifications per the terms of their DPA.
05
Contact
For questions about subprocessors or to request a DPA for execution: legal@nebulahex.com.
For privacy-specific questions: privacy@nebulahex.com.
Last updated: May 24, 2026.