Sub-processors

1 Sub-processors

Each provider states when it is involved. The legal entity, country and international transfer mechanisms appear only if they were verified in an official source: the provider’s terms or DPA, or the Data Privacy Framework list. Each item links to its source.

1. Neon

   Entity Databricks, Inc.

   Country United States

   Hosting of the PostgreSQL database containing account, operational, and customer data.

   When it is involved Core infrastructure.

   International transfer, as stated by the provider

   • Certification under the EU-U.S. Data Privacy Framework
   • UK Extension to the Data Privacy Framework
   • Swiss-U.S. Data Privacy Framework
   • European Commission Standard Contractual Clauses
   • UK International Data Transfer Addendum or Agreement

2. Vercel

   Entity Vercel Inc.

   Country United States

   Hosting, request execution, technical logs, and aggregated web analytics.

   When it is involved Core infrastructure; paths containing identifiers are redacted before Web Analytics.

   International transfer, as stated by the provider

   • Certification under the EU-U.S. Data Privacy Framework
   • UK Extension to the Data Privacy Framework
   • Swiss-U.S. Data Privacy Framework
   • European Commission Standard Contractual Clauses
   • UK International Data Transfer Addendum or Agreement

3. Anthropic

   Entity Anthropic, PBC

   Country United States

   Text processing for AI features, including quotes and collections when used.

   When it is involved Only when an AI feature is invoked.

   International transfer, as stated by the provider

   • European Commission Standard Contractual Clauses
   • UK International Data Transfer Addendum or Agreement

4. Resend

   Entity Plus Five Five, Inc.

   Country United States

   Delivery of transactional email and management of the double-opt-in newsletter.

   When it is involved When Cord sends email or a user confirms an editorial subscription.

   International transfer, as stated by the provider

   • Certification under the EU-U.S. Data Privacy Framework
   • UK Extension to the Data Privacy Framework
   • European Commission Standard Contractual Clauses
   • UK International Data Transfer Addendum or Agreement

5. PostHog

   Entity PostHog, Inc.

   Country United States

   Product analytics. Browser capture starts after consent; the server may emit organization-level business telemetry without creating a person profile.

   When it is involved Only when PostHog is configured; browser capture requires analytics consent.

   International transfer, as stated by the provider

   • Certification under the EU-U.S. Data Privacy Framework
   • UK Extension to the Data Privacy Framework
   • Swiss-U.S. Data Privacy Framework
   • European Commission Standard Contractual Clauses
   • UK International Data Transfer Addendum or Agreement

6. Upstash

   Entity Upstash, Inc.

   Country United States

   Distributed rate limiting and ephemeral technical sessions.

   When it is involved Only when Upstash environment variables are configured; PostgreSQL is the fallback.

   International transfer, as stated by the provider

   • Certification under the EU-U.S. Data Privacy Framework
   • UK Extension to the Data Privacy Framework
   • Swiss-U.S. Data Privacy Framework
   • European Commission Standard Contractual Clauses
   • UK International Data Transfer Addendum or Agreement

7. Slack (alertas de Cord)

   Entity Slack Technologies Limited

   Country Ireland

   Receipt of minimized operational alerts through a Cord-controlled webhook.

   When it is involved Only when the internal webhook is configured.

   International transfer, as stated by the provider

   • European Commission Standard Contractual Clauses
   • UK International Data Transfer Addendum or Agreement

8. Facturapi

   Preparation, stamping, and retrieval of CFDI, including the CSD configured by the business.

   When it is involved Only for Mexican CFDI when the provider is configured.

2 Providers with their own legal duties

They may determine part of the processing and have their own legal duties, such as the financial regulation that applies to whoever processes a payment. Their role can vary by product and data, so they are listed separately.

1. Stripe

   Subscriptions, payments, refunds, disputes, payouts, and financial/identity verification. Its role depends on the product and may include independent regulatory duties.

   When it is involved When billing or Cord Payments is used.

2. Google

   User-selected OAuth authentication; Cord receives the authorized identifier, name, and email.

   When it is involved Only when Google sign-in is selected.

3. Apple

   User-selected authentication; Cord receives the identifier and data authorized by Apple.

   When it is involved Only when Apple sign-in is selected.

4. Mercado Pago

   Collecting quotes and invoices with the Customer’s Mercado Pago account, and reading payments and refunds to reconcile them.

   When it is involved Only if the Customer connects their account.

3 Announced changes

A change takes effect at least 30 days after it is announced. An urgent security change applies immediately and is announced as soon as it applies.

No changes have been announced yet.

4 Email notices

Subscribe and we will email you as soon as a change is announced, at least 30 days before it takes effect.

If you object to a change, write to legal@flouvia.com before its effective date.