1. Overview
These are the companies that process data to run Nepteo. The list is built from the software we actually use. Our database is hosted in the EU (Paris), but the data path is wider: Vercel, OpenAI, Anthropic, Google, Stripe, Sentry, PostHog, Resend, Upstash and Brave are US companies. Hosting your database in Paris does not remove that. Supabase is not a US company in our contract: our contracting party is Supabase Pte. Ltd. (Singapore), and it hosts our database in Paris (AWS eu-west-3).
Your data is exportable at any time from Settings.
2. Sub-processors
| Provider | Role | What is sent | Processing region | Terms |
|---|---|---|---|---|
| Supabase Pte. Ltd. (Singapore) | Database, authentication, file storage | All your account data and content: database, authentication, files. | Database hosted in Paris (AWS eu-west-3) | Terms |
| Vercel | Application hosting and delivery | Your requests to the app, and the technical logs of those requests (IP address, addresses visited, errors). | Functions in Paris (cdg1), global delivery network | Terms |
| OpenAI | Search embeddings, image reading, read-aloud voice and activity analysis | Text sent to compute search embeddings, where OpenAI is our primary provider (memory, recall, documents, chat search); images you give the assistant, receipts and document images, to read them; text read aloud; and activity data analysed to suggest patterns and ideas. | United States | Terms |
| Anthropic | Language model (LLM) provider: Claude | The content the assistant works on to answer you: your messages, and the documents, contacts and memory it needs. | United States | Terms |
| Google (Gemini API) | Backup language model (LLM), used only if Anthropic does not answer, and backup for search embeddings | The same kind of content when Gemini steps in for Anthropic. For voice, your audio and memory context go from your browser to Google with a short-lived token. Also the fallback for search embeddings (model gemini-embedding-001), used only when OpenAI, our primary embedding provider, does not answer. | Global infrastructure | Terms |
| Stripe | Payments and subscriptions | Email, plan and payment details for subscriptions. Card numbers are entered on Stripe, not stored by us. | Ireland (EU) and United States | Terms |
| Resend | Transactional email delivery | Recipient addresses and content of the emails Nepteo sends from its own address (confirmations, reminders, notices), and of the emails you ask the assistant to send only when no Gmail connection can send them; also the incoming emails received at our address. Emails sent from your connected Gmail mailbox go through Gmail, not through Resend. | Region not confirmed yet | Terms |
| PostHog | Product analytics | Only after you accept analytics: pages and clicks in your browser, on-screen text masked. From our servers, also only after you accept: which feature was used, under a pseudonymous identifier, with fixed fields only and no message content. | EU instance (eu.i.posthog.com) | Terms |
| Sentry | Error monitoring | Technical error reports: error message, where it happened, browser. We do not send request bodies or user profile data by default. Error reports can still carry log lines and breadcrumbs, which may contain excerpts of a message of up to about 100 characters, and the extra fields our error logging attaches. | Region not confirmed yet | Terms |
| Langfuse | AI request tracing (quality and cost) | Only if tracing is switched on: request metadata (model, tokens, cost, timing), no message text. Default host: cloud.langfuse.com, unless we set another. | Region not confirmed yet | Terms |
| Upstash | Rate limiting and short-lived cache | Usage counters for rate limiting (quotas). No message content. | Region not confirmed yet | Terms |
| Brave Search API | Web search requested by the assistant | The search query the assistant writes when you ask it to search the web. It may contain what you asked about. | United States | Terms |
| Google Fonts | Fonts loaded by your browser (your IP address reaches Google) | Your IP address and browser details, when fonts load. | Global infrastructure | Terms |
3. AI training
We do not claim more than each provider's own terms say. For each AI provider, here is what its published terms state about API data, with the source, or that we have not confirmed it.
- OpenAI: States that API data is not used to train its models by default. Source
- Anthropic: States that API data is not used to train its models by default. Source
- Google (Gemini API): States that API data is not used to train its models by default. Source
The other providers on this list do not provide AI models to Nepteo, so no training statement applies to them.
4. Transfers outside the EU
Some providers process data in the United States. Depending on the provider, the transfer relies on the Standard Contractual Clauses (SCCs) adopted by the European Commission or on the EU-US Data Privacy Framework. The terms linked above set out what each provider applies. Where a region is marked as not confirmed, we have not verified it and we say so rather than guess.
5. Changes
When we add or replace a provider, this page is updated first. We notify existing users by email at least 30 days before adding a new sub-processor or making a material change to this list. If you object to a new sub-processor, you may terminate your subscription before the change takes effect.