Sub-processors
Last updated: June 8, 2026
A sub-processor is a third party that processes personal data or user content on our behalf to deliver NodePad. We use the providers below. We require each to offer protections consistent with applicable data-protection law (e.g. via a Data Processing Agreement and, for transfers out of the EU/UK, Standard Contractual Clauses or an equivalent mechanism).
When you use NodePad’s AI features, the content you submit (prompts, referenced messages, attachments, and related workspace content) is transmitted to the model provider that serves your selected model in order to generate a response.
Our core application data (accounts, workspaces, content) is hosted in the EU. Transfers outside the EU are limited to the model providers (AI generation), Stripe (payments), and our edge and authentication providers (Cloudflare; Apple and Google sign-in) for connection metadata and authentication.
| Provider | What it does | Data involved | Processing location |
|---|---|---|---|
| Hetzner | Application hosting (application and database) | All account + user content | Helsinki, Finland (EU); database move to AWS Frankfurt (eu-central-1) planned |
| Cloudflare R2 | Object storage (attachments / exports) | User-uploaded content | Eastern Europe (EEUR) |
| Cloudflare | CDN / network / security in front of the app | Connection metadata, IP address | Global edge |
| Amazon Web Services (SES) | Sends account email (verification, magic links, billing) | Email address | Frankfurt (eu-central-1), EU |
| PostHog | Product analytics & session replay (consented) | Usage events, masked session replay, device/approx. location | EU |
| Stripe | Payments, subscriptions, tax calculation, billing | Name, email, billing details (card data handled by Stripe; we never store it) | United States and global |
| Anthropic (Claude) | LLM inference for Claude models | Prompts + referenced content for generation | United States |
| OpenAI | LLM inference for GPT models | Prompts + referenced content for generation | United States |
| LLM inference for Gemini models | Prompts + referenced content for generation | United States | |
| OpenRouter (and downstream hosts) | LLM routing/inference for the Free plan’s open models; downstream hosts may retain content under their own terms | Prompts + referenced content for generation | United States and global |
| Apple / Google (Sign-in) | Social login (authentication) | Account identifier, email | US / global |
We may update this list as our providers change; we will post changes here and, for material changes, notify account holders by email.
Contact for data questions: [email protected] — The Palaz Company LLC, 1209 Mountain Road PL NE STE N, Albuquerque, NM 87110, USA.