Subprocessors
These companies process personal data on Eno’niva’s behalf. Each receives only what it needs for its task, under a contract that limits its use of the data. Our database and files are hosted in the EU (Helsinki, Finland). Where data goes to a country without an EU adequacy decision, we rely on the EU Standard Contractual Clauses (SCCs) and the UK addendum, or on the provider’s certification under the EU-US Data Privacy Framework (DPF). See our Privacy Policy.
Core service
| Provider | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Server hosting, database, backups | All data stored by Eno’niva | Helsinki, Finland (EU) | No transfer (EU) |
| Bird (MessageBird B.V.) | Sending emails: sign-in codes, invites, ask notifications | Recipient email and name, email content | United States (our Bird account’s region); moving to Bird’s EU region | SCCs (Bird DPA) |
| Stripe | Payments and subscriptions | Name, email, workspace name; card details collected by Stripe directly | United States, Ireland | DPF and SCCs (Stripe DPA) |
| Namecheap | Domain name system and forwarding of email sent to our addresses | Emails you send us (sender, content) | United States | SCCs (agreement being finalized) |
| jsDelivr (Prospect One) | Delivering web fonts and code libraries to your browser | IP address and browser details of visitors | Poland (EU) operator; global delivery network | Legitimate interest; IPs aggregated and deleted within hours (per jsDelivr) |
Keeping cards accurate
| Provider | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Treg (Superdesign) | Professional profile lookups (job, company, photo) from public LinkedIn profiles, via third-party data providers | Public LinkedIn profile URL and name (for a search outside the network: the name and any company or city the member typed) | United States (hosted on Render, Oregon) | Standard Contractual Clauses (to confirm) |
| Exa Labs | Web search for a person’s public professional details | Names, company names, email domains, cities (never phone numbers or full email addresses) | United States | SCCs (agreement being finalized) |
| TypeSafe AI (Jev) | Classifying organizations, spotting machine senders, checking that a public profile matches a contact | Organization names and domains; a sender’s address and display name; name, company, email domain, city and public evidence for a match check | United States | SCCs (agreement being finalized) |
| Anthropic | Classifying organizations by industry, and listing company names from public fund portfolio pages (paid plans) | Organization names and web domains; the text of public fund portfolio pages, which may name the fund’s partners | United States | SCCs (Anthropic DPA) |
| Google (Gemini API) | A quick check whether a person still holds the job on their card (one-word answer: same, changed, retired or unsure); only the answer is kept | Name, job title and company only | United States | SCCs (Google Cloud data processing terms, paid tier; Google keeps prompts up to 30 days for search grounding) |
| Perplexity AI | Recent news about a person when a member opens it, and checking a person’s current role and public professional history (with sources) | Name, job title, company, city or country, LinkedIn link | United States | SCCs (Perplexity DPA) |
Only when used
| Provider | Purpose | Personal data | Location | Status |
|---|---|---|---|---|
| Google Workspace connector, “Connect Google Contacts” for members, and “Sign in with Google”, when a company or member chooses them | Data the company’s Google Workspace provides (directory, contacts, mail headers, calendar attendees); a member’s own Google Contacts and “other contacts” (Gmail headers only for invited testers); sign-in identity | United States and global | Connector available to workspaces; sign-in not yet active DPF | |
| Microsoft | Microsoft 365 connector, “Connect Outlook / Microsoft 365” for members, and “Sign in with Microsoft” | As for Google, from the company’s Microsoft 365 tenant; a member’s own Outlook contacts and mail headers (addresses and dates, never subjects or text) | United States and global | Not yet active DPF |
| Meta (WhatsApp Business) | Sending sign-in codes by WhatsApp | Phone number, one-time code | United States and other Meta data centers | Not yet active |
| Plivo | Sending sign-in codes by SMS | Phone number | United States | Not yet active |
For company workspaces, the company’s own Google Workspace or Microsoft 365 is the source of connector data, under the company’s agreement with that provider. For a member’s connected Outlook or Google account, Microsoft or Google is a data source acting under the member’s own authorization and agreement with them, not a processor for Eno’niva; disconnecting deletes our access. Apple distributes our iPhone app; we don’t send member data to Apple.
Changes to this list
We update this page before a new provider starts processing personal data and change the date at the top. Company workspace owners get at least 30 days’ notice by email and may object under their data processing agreement. Questions: privacy@enoniva.com.
This page is pending final legal review.