Sub-processors
Draft for legal review. Text in [square brackets] is completed before publication. If a translation differs from the English version, the English version prevails.
Nabo uses the following companies to process personal data. Building data is stored in the European Union. Where a company processes data outside the EU or EEA, the transfer is covered by the European Commission's Standard Contractual Clauses (SCCs). For Albania, transfers rely on the Commissioner's list of adequate countries or on equivalent clauses, with a documented risk assessment.
| Company | What for | Where | Transfer basis |
|---|---|---|---|
| Supabase Inc. (on Amazon Web Services, region eu-west-3) | Database, sign-in, file storage and the app's back end | Paris, France | Data stays in the EU; SCCs cover support access from the United States |
| GoDaddy Operating Company, LLC | All emails from info@nabo-app.org: sign-in, invites, announcements, weekly digests and export links | United States | SCCs |
| Apple Inc. (Apple Push Notification service) | Push notifications | United States | SCCs |
| DeepL SE | Translating a post when someone asks | Germany | In the EU |
| Functional Software, Inc. (Sentry, EU region) | Crash reports, without personal data | Germany | Data stays in the EU; SCCs cover support access from the United States |
| TelemetryDeck GmbH | Anonymous, aggregate usage counts | Germany | In the EU |
| Google Ireland Ltd. (Firebase Hosting) | This website and the sign-in link page | Global network, United States | SCCs |
Managers see the same list in the app under Admin → Privacy and data. We announce new sub-processors to customers at least 30 days in advance, and a customer may object (see the data processing agreement, section 7).