Last updated: 2026-04-28.
The following third-party service providers process limited personal data on behalf of NOVA. Each is contractually bound to handle data in accordance with applicable privacy laws.
| Subprocessor | Purpose | Location | Data Categories |
|---|---|---|---|
| Anthropic | LLM API (Claude Sonnet/Opus) for paid-tier responses | USA | Chat content, prompts, model outputs |
| OpenAI | LLM API (gpt-4o-mini) for free-tier and tool-use | USA | Chat content, prompts, embeddings |
| Supabase | Database, Authentication, Storage | USA / EU available | Profile, account email, chat metadata |
| Lemon Squeezy | Payment processing (Merchant of Record) | USA / Global | Email, billing address, payment method (PCI-handled by LS) |
| Iubenda | Privacy policy and cookie banner generation | EU | Domain configuration only — no user PII |
| DigitalOcean | Hosting infrastructure (droplet) | USA | IP addresses, request logs (system-level) |
| Namecheap | Domain registrar and email forwarding | USA | Email forwarded to support@/privacy@/security@/abuse@ |
| Groq | LLM API (cascade fallback only) | USA | Chat content (only when Anthropic/OpenAI fail) |
| Google (Gemini) | LLM API (cascade fallback only) | USA | Chat content (only when prior providers fail) |
| DeepSeek | LLM API (cascade fallback only, currently disabled) | China | Currently no data flow (key not configured) |
| Pushover | Founder-side alert notifications (Mahir only) | USA | System alerts — no end-user PII |
| Sentry | Error tracking and performance monitoring | USA | Stack traces with PII scrubbed before send |
| Google Fonts | Web fonts (Inter) | USA | IP addresses (font CDN load only) |
If NOVA adds a new subprocessor, this page is updated within 30 days. To subscribe to subprocessor updates, email privacy@novabrain.dev with subject "Subprocessor updates".
Contact privacy@novabrain.dev.