Subprocessors
Last updated: 8/3/2026
Subprocessors
Last updated: 2026-07-19
Nesktop uses selected third-party subprocessors to provide the Service. This page lists each subprocessor, the service it provides, its jurisdiction, and its current status.
Changes to this list are notified in accordance with the change notice section below.
Current subprocessors
| Subprocessor | Service | Jurisdiction | Status |
|---|---|---|---|
| OVH | Hosting and infrastructure (server, storage, network) | Germany (OVH data centre) | Active — confirmed. All primary service data is stored in OVH's German data centre. |
| OAuth authentication / identity provider | Global (Google infrastructure) | Active — only when used. Google processes data only when you or a user chooses Google sign-in. | |
| Cloudflare | Anti-abuse and security (Turnstile) | Global (Cloudflare edge network) | Active — only when used. Cloudflare processes IP address and user-agent data for Turnstile challenges when that feature is enabled. |
| Email / SMTP provider | Transactional email delivery (verification, security alerts, service notices) | Configurable — provider not yet confirmed | Configured / not yet confirmed. Nesktop uses a generic SMTP service for transactional email. The specific provider and jurisdiction are not yet finalised. This entry will be updated when the provider is confirmed. |
| GoDaddy | Domain name registrar | Global | Infrastructure. GoDaddy processes domain registration data only. No user content is shared. |
| Lemon Squeezy | Merchant of Record (payment processing) | Global | Future — not yet live. Lemon Squeezy is intended as our payment processor. Checkout is not live and no payment data is processed. |
| Stripe | Payment processing | Global | Configured — not yet active. Stripe integration is configured in the codebase but is not actively processing payments. |
Status categories:
- Active — confirmed: The subprocessor is actively engaged and used under a data processing agreement.
- Active — only when used: The subprocessor is engaged but processes data only when the relevant feature is enabled or used by a customer.
- Configured / not yet confirmed: The subprocessor is configured or intended but the contractual relationship is not finalised.
- Infrastructure: The subprocessor provides domain or infrastructure services that do not involve access to user content.
- Future — not yet live: The subprocessor is intended but not yet operational.
- Configured — not yet active: The integration exists in code but is not processing data.
Change notice
We may update this list as our subprocessors change. When we add or replace a subprocessor that processes personal data (as opposed to infrastructure-only services), we will notify customers by email or through the Service at least 14 days before the new subprocessor begins processing, unless a shorter notice period is required by urgency or replacement of a non-performing subprocessor.
If you object to a new subprocessor, you may terminate your agreement with Nesktop in accordance with the termination provisions of the applicable terms. To exercise this right, contact nesktopinfo@gmail.com within the notice period.
Contact
For questions about subprocessors, contact nesktopinfo@gmail.com.