Subprocessors and providers
Last updated:
This page lists the providers that process personal data for the clevernursery.com website and the app.clevernursery.com application, published by CIRTA AGENCY LTD. It is based on the infrastructure and code actually in service. Customers are told about later additions or replacements of subprocessors as set out in the data processing agreement.
1. Infrastructure
| Provider | Service | Data concerned | Location | Safeguards |
|---|---|---|---|---|
| Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, United States) | Hosting of the marketing website clevernursery.com | Visitors' technical logs (IP, pages), contact form content in transit | Global network; the site's server functions in the United States | Data Processing Addendum (GDPR, UK GDPR; standard contractual clauses and UK addendum) |
| Contabo GmbH (Welfenstrasse 22, 81541 Munich, Germany) | Hosting of the application server: application, PostgreSQL database, uploaded files | All application data (section 5 of the privacy policy) | TODO — CONFIRM THE CONTABO DATA CENTRE USED BY CLEVER NURSERY | Contabo DPA (GDPR); terms; privacy |
| Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, United States) | Domain DNS; routing, TLS encryption and protection of the application's traffic; routing of email received at @clevernursery.com addresses | Application traffic in transit (including its content), IP addresses, metadata and content of incoming email | Global network | Cloudflare's data processing agreement: TODO — INFORMATION TO BE CONFIRMED (acceptance) |
2. Services
| Provider | Service | Data concerned | Location | Role |
|---|---|---|---|---|
| Resend, Inc. (United States) | Sending email: contact form, sign-in codes, resets, sign-up reviews, billing, notifications to families | Recipient address, message content (never health data) | United States; sending observed through Amazon SES infrastructure in region eu-west-1 (Ireland) | Processor |
| Stripe (contracting entity: TODO — INFORMATION TO BE CONFIRMED) | Card payment of euro subscriptions, automatic renewal, receipts | Name, email, card data (handled directly by Stripe), amounts | United States and European Union | Processor for payments; independent controller for its own obligations (fraud prevention, regulatory duties) |
| Chargily (Algeria) | Online payment of dinar subscriptions (CIB, Edahabia) | Payment data (handled directly by Chargily), amount, reference | Algeria | Payment provider |
| Google (Google Analytics 4) | Analytics for the application | Pseudonymous cookie identifiers, cleaned page addresses, device, browser, approximate location | United States and other countries | Processor for CIRTA AGENCY LTD |
3. Tools planned but not enabled
The following tools are provided for in the code but are not enabled: Google Analytics, Google Ads and the Meta pixel on the marketing website (they would only load after consent), newsletter sign-up through Brevo, sign-in through an external identity provider (OIDC). They process no data while disabled; this page will be updated before any of them is enabled.
4. Transfers outside the European Union, the United Kingdom and Algeria
Several providers are in the United States. Transfers rely on the safeguards provided in their data processing agreements (European Commission standard contractual clauses, UK addendum, or certification under the Data Privacy Framework where the provider holds it). See "International transfers" in the privacy policy.
5. Contact
Questions, or a customer's objection to a subprocessor: legal@clevernursery.com.