Valifiy Vendor and Subprocessor List
Version: 1.0
Effective date: 19 October 2026
This document identifies the third-party providers Valifiy LLC uses in connection with the Service and explains the role each provider has in processing Personal Data.
1. Purpose and classification
This document distinguishes: (1) processors and subprocessors that process Personal Data on Valifiy's instructions; (2) providers that act in mixed roles or as independent controllers for specified processing; and (3) operational vendors that are not intended to receive or process Service User Personal Data.
Capitalized terms not defined here have the meanings given in the Valifiy Terms of Service, the Valifiy Privacy Policy and, where applicable, the Valifiy B2B Data Processing Addendum.
This document does not describe Valifiy's technical and organizational security controls. Those controls are set out for B2B Customers in Schedule 3 - Technical and Organizational Measures of the Valifiy B2B Data Processing Addendum.
Where Valifiy determines the purposes and means of processing Personal Data, a provider that processes that Personal Data on Valifiy's instructions acts as a processor or service provider. Where Valifiy processes Customer Personal Data on behalf of a B2B Customer, a provider engaged by Valifiy to perform that processing acts as a subprocessor. A provider may act as an independent controller for activities for which it determines the purposes and means of processing. Inclusion in this document does not mean that a provider receives every listed category of Personal Data; each provider receives only the data involved in the services it performs.
2. Processors and subprocessors
| Provider | Service and role | Personal Data processed | Processing locations and transfer mechanism |
|---|---|---|---|
| Google Cloud Platform and Firebase | Cloud infrastructure, authentication, Firestore database, Cloud Storage and Cloud Functions. Processor/service provider, and subprocessor where Valifiy processes Customer Personal Data for a B2B Customer. | Account data, profile data, authentication identifiers, IdeaBoard content, usage data and technical data. Credentials are handled through Firebase Authentication. | Production Cloud Storage: europe-central2, Warsaw. Production and staging Firestore: eur3 Europe multi-region, with read-write regions europe-west1, Belgium, and europe-west4, Netherlands, and witness region europe-north1, Finland. Staging Cloud Storage and Cloud Functions: europe-west1, Belgium. Firebase Authentication is a global Google Identity service. Transfers use applicable Google data-processing terms, Standard Contractual Clauses or another lawful mechanism where required. |
| Render | Backend API hosting for the Node.js/NestJS application. Processor/service provider, and subprocessor where Valifiy processes Customer Personal Data for a B2B Customer. | API request data, account data, IdeaBoard content and technical data required to host and operate the backend. | Primary production and staging deployment region: eu-central-1, Frankfurt, Germany. Transfers use applicable Render terms, Standard Contractual Clauses or another lawful mechanism where required. |
| MyCity Hosting (Predrag Damnjanović PR Ostale telekomunikacione delatnosti My City Nikola Tesla), Serbia | Hosting for the WordPress marketing website, including web servers, backups and server logs. Processor/service provider for the website. MyCity identifies Hetzner as its only subprocessor for hosted data and requires at least 30 days' notice before adding another subprocessor. | Website visitor IP addresses, user-agent information, request metadata, server logs and hosted website data. Website hosting does not store account, IdeaBoard or payment data. | MyCity Hosting is established in Serbia. Hosting and backup systems are in Hetzner data centers in Germany (Nuremberg and Falkenstein/Vogtland) and Finland (Helsinki), within the EU. Administrative access may occur from Serbia when technically necessary. The applicable data center is specified in the order. Website hosting is governed by MyCity Hosting's published data-protection policy. |
| Hetzner Online GmbH | Infrastructure subprocessor providing data-center, server, network and power infrastructure to MyCity Hosting for the website. | Hosted website data is stored on Hetzner infrastructure. Hetzner does not have access to hosted content. | Infrastructure locations: Germany (Nuremberg and Falkenstein/Vogtland) and Finland (Helsinki). A Data Processing Agreement under Article 28 GDPR is in place between MyCity Hosting and Hetzner Online GmbH. |
| OpenAI | Core AI generation through the OpenAI API. Processor/service provider, and subprocessor where Valifiy processes Customer Personal Data for a B2B Customer. | User-entered business idea text is sent to OpenAI together with Valifiy system prompts and selected IdeaBoard elements necessary to generate the requested output. | Processing locations and transfer safeguards are governed by the OpenAI Data Processing Addendum, applicable Standard Contractual Clauses and OpenAI's current subprocessor information. |
| EasyDMARC | DMARC analysis and email-security monitoring. Processor/service provider, and subprocessor where the service processes Customer Personal Data for a B2B Customer. | DMARC aggregate and forensic reports and related domain, sending-source and authentication-result data for valifiy.com. | Processing locations and transfer safeguards are governed by the applicable EasyDMARC service and data-processing terms. |
| Brevo | Marketing e-mail delivery, subscription and preference management, and campaign-delivery analytics. Processor/service provider, and subprocessor where Valifiy processes Customer Personal Data for a B2B Customer. | Recipient name and e-mail address, subscription and consent status, campaign delivery and engagement data, and related technical metadata. | Processing locations and transfer safeguards are governed by Brevo's applicable data-processing terms and current subprocessor information. Transfers use Standard Contractual Clauses or another lawful mechanism where required. |
| SMTP2GO (Sand Dune Mail Ltd) | Transactional e-mail delivery for account, authentication, security, support and Service notifications. Processor/service provider, and subprocessor where Valifiy processes Customer Personal Data for a B2B Customer. | Recipient name and e-mail address, message headers and content, delivery and status data, and related technical metadata. | Processing occurs in the data-center region configured for Valifiy's SMTP2GO account and through SMTP2GO's current subprocessors. Transfers use the applicable data-processing terms, Standard Contractual Clauses or another lawful mechanism where required. |
3. Providers with mixed or independent-controller roles
| Provider | Service | Role | Personal Data and purpose |
|---|---|---|---|
| Stripe | Payment processing, payment authentication, purchases, invoices and fraud prevention. | Processor/service provider for payment facilitation; separate controller for fraud prevention, legal and regulatory compliance, and other purposes determined by Stripe under its applicable terms. | Name, email address, billing address, payment-method and card details submitted directly to Stripe, transaction amount and description, customer and payment identifiers, device and IP information, and fraud-prevention signals. Valifiy does not receive or store full payment-card numbers. |
| Google Analytics | Website analytics using Google Analytics 4. Used only for performance measurement and Service improvement; not used for advertising. | Processor/service provider for analytics configured by Valifiy under the applicable data-processing terms. Google may act as an independent controller for processing performed for its own security, legal or other purposes under its terms. | Online identifiers, cookie and device identifiers, IP-derived information and usage or event data, subject to the active configuration and consent choices described in the Valifiy Cookie and Similar Technologies Policy. |
| Google Identity Services and Google OAuth | Federated sign-in and authentication. | Google may act as an independent controller for the user's Google Account and its direct provision of identity services. Firebase-related processing on Valifiy's instructions is covered in Section 2. | Google Account identifier, name, email address, profile information, authentication tokens and related technical data, depending on the permissions used by Valifiy. |
| Google Fonts | Delivery of website and application fonts from fonts.googleapis.com and fonts.gstatic.com. | Processor/service provider for font delivery; Google may act as an independent controller for processing performed for its own security, legal or other purposes under its terms. | IP address, user-agent, referrer and related request metadata. No account, IdeaBoard or payment data. Font requests do not set cookies. Requests are served from Google infrastructure; transfers use applicable Google terms, Standard Contractual Clauses or another lawful mechanism where required. |
4. Operational vendors not intended to process Service User Personal Data
| Provider | Function | Current data scope |
|---|---|---|
| GitHub | Source-code hosting and CI/CD. | Source code, developer account information and deployment metadata. Valifiy does not intentionally store Service User Personal Data, production secrets or user exports in the repository. |
| npm | Package registry and build-time dependencies. | Package and build metadata. Valifiy does not intentionally provide Service User Personal Data to npm. |
5. Provider data use and retention
5.1 Logging and retention
| Provider | Logging or content capture | Current retention |
|---|---|---|
| Google Cloud Platform and Firebase | Firebase technical logs contain HTTP metadata and do not contain request or response bodies, prompts or IdeaBoard content. Service data is stored as required to provide the Service. | Firebase technical logs are retained for 30 days. Account and IdeaBoard data are retained and deleted in accordance with the Valifiy Privacy Policy and applicable backup cycles. |
| Render | Render processes API requests necessary to operate the backend. Its technical logs contain HTTP metadata and do not contain request or response bodies, prompts or IdeaBoard content. | Render technical logs are retained for 7 days under the current Hobby plan. |
| MyCity Hosting | Website access and error logs record IP address, date/time, requested URL, HTTP method/status, response size, referer and user-agent. Hosting panel, mail, FTP and SSH logs record IP address and successful or failed login time. Logs do not contain email content, passwords, database content or form data. | Logs, including rotated logs, are retained for 30 days and automatically deleted. Logs are not included in backups. Website backups are created daily and retained for 7 days under the current hosting service; the applicable plan and data center are stated in the order. |
| Hetzner Online GmbH | Hetzner provides data-center, server, network and power infrastructure and does not access hosted content. Website logs and backups are managed by MyCity Hosting under the retention periods stated above. | Infrastructure subprocessor; website logs and backups follow MyCity Hosting's retention periods. |
| OpenAI | Platform audit logging and API-call logging are disabled. Request content may still be retained for abuse monitoring. Zero Data Retention is not enabled. | Request content may be retained for up to 30 days for abuse monitoring. |
| EasyDMARC | The service processes DMARC aggregate and forensic reports and related email-security information for valifiy.com. | The current free plan provides 14 days of report history. |
| Brevo | Processes contact, subscription, campaign-delivery and engagement data needed to send and manage marketing communications. | Retained under Valifiy's current Brevo account settings and Valifiy's marketing-record retention rules; unsubscribe or suppression records may be retained as needed to honor opt-out choices. |
| SMTP2GO (Sand Dune Mail Ltd) | Processes message headers, content and delivery or status metadata needed to send transactional e-mails and protect deliverability. | E-mail activity data is retained for 35 days by default, subject to Valifiy's configured Activity Storage Duration and any optional archiving settings. |
| Google Analytics | Google Analytics 4 collects online identifiers, cookie and device identifiers, IP-derived information and usage or event data on the website, and in the application when analytics is enabled. Collection is gated by the shared analytics consent choice. | Event data and user data are retained for 14 months. Reset on new user activity is enabled. |
| Stripe | Stripe processes payment and transaction information in accordance with its applicable terms and legal or regulatory obligations. Valifiy retains only limited payment and invoice metadata. | Stripe determines retention for processing it performs as an independent controller. Valifiy's limited payment metadata follows the retention periods in the Valifiy Privacy Policy. |
| Google Identity Services and Google OAuth | Google processes authentication and Google Account information under its applicable terms. Valifiy retains authentication identifiers required for the user's account. | Google-controlled data follows Google's applicable retention terms. Valifiy-controlled authentication data follows the account-retention rules in the Valifiy Privacy Policy. |
5.2 AI model training and independent provider use
OpenAI API Customer Data is not used to train OpenAI models under Valifiy's current API settings. Valifiy has not opted in to model training. This statement concerns model training and is separate from the request-content retention described in Section 5.1.
Stripe may use transaction and Personal Data as an independent controller for fraud and loss prevention, authentication, security, regulatory compliance and improvement of its payment services, including the development of fraud-prevention models, as described in Stripe's applicable terms.
6. B2B authorization and responsibility
The general authorization given by a B2B Customer for Valifiy's use of subprocessors is governed by the Valifiy B2B Data Processing Addendum and the applicable Valifiy B2B Service Agreement. Valifiy imposes applicable data-protection obligations on subprocessors and remains responsible for their processing to the extent required by applicable law and the Valifiy B2B Data Processing Addendum.
7. Changes and objections
Valifiy maintains this document as the current list of providers used in connection with the Service.
Where Valifiy processes Customer Personal Data on behalf of a B2B Customer, Valifiy gives that Customer written notice of intended additions or replacements of subprocessors at least 7 calendar days before the new provider processes that Customer's data, allowing a longer period where reasonably necessary for a meaningful opportunity to object. The general authorization, notice and objection procedure is set out in Section 7 of the Valifiy B2B Data Processing Addendum.
If a data-protection objection cannot be resolved, the affected Services may be terminated under that procedure. The objection does not prevent Valifiy from using the provider for other customers.
8. Contact
Questions about this document or Valifiy's use of providers may be sent to privacy@valifiy.com.