Subprocessors
Third parties that process personal data on behalf of Núvols to deliver the nuvols.app service. Last updated: April 2026.
Why this page exists
Under the EU General Data Protection Regulation (Article 28), when Núvols processes personal data on behalf of a merchant (acting as a data processor), we must disclose every third party we engage to help deliver the service (our subprocessors). This lets merchants — who remain controllers of their shoppers' data — cascade their own obligations and assess the transfer chain.
All subprocessors listed below have signed a Data Processing Agreement (DPA) with Núvols or operate under the EU Standard Contractual Clauses. Where applicable, international transfers outside the European Economic Area rely on the EU-US Data Privacy Framework or SCC Module 3.
Current subprocessors
| Entity | Location | Purpose | Agreement |
|---|---|---|---|
| Cloudflare, Inc. | United States | Edge hosting, Workers runtime, D1 database (merchant accounts, OAuth credentials, analytics events), KV storage (product catalog cache, configuration), Durable Objects (transient checkout session state), email routing, Turnstile CAPTCHA, Web Analytics (cookieless, aggregated site-usage statistics). Applies to all users. | DPA · Privacy |
| Brevo SAS | France (EU) | Transactional email delivery for contact-form verification codes. Receives recipient email addresses only. Applies to website visitors who submit the contact form. | Terms · Privacy |
| Google LLC | United States | Google Shopping / Merchant Center UCP order event webhook delivery. Applies only to merchants who connect a Google Merchant Center account. Not used for site visitors or analytics. | Processor Terms · Privacy |
| Stripe, Inc. | United States | Payment tokenization for ACP (ChatGPT) checkout flows. Receives payment instrument data during a checkout session. Applies only to merchants on the Pro tier with ACP enabled. | DPA · Privacy |
| OpenAI, LLC | United States | ACP order event webhook delivery — when a buyer completes a purchase through ChatGPT, order metadata (line items, totals, fulfillment status) is transmitted to OpenAI so the AI agent can inform the buyer of status updates. Applies only to merchants on the Pro tier with ACP enabled and an OpenAI-issued OAuth client. | DPA · Privacy |
Notification of changes
Núvols commits to giving merchants at least thirty (30) days' notice before adding or replacing a subprocessor that processes merchant or buyer personal data. Notice is given by:
- • Updating this page (the date above changes).
- • Emailing the primary account contact of each merchant on the Pro tier.
- • Posting a notice in the merchant dashboard for at least 30 days before the change takes effect.
Merchants who object to a new subprocessor may terminate their subscription before the change takes effect; contact us through the form on our About page.
Related
- • Terms of Service — the overall agreement between Núvols and each user.
- • Privacy Policy — full description of what data we process and why.
- • Data Processing Agreement — the GDPR Article 28 terms that govern our processing of merchant and buyer personal data. Countersigned copies are available on request via the About page.