Legal · Annex A

Sub-Processors

Last updated: October 20, 2026 · Document version Beta v0.1

We engage sub-processors under written contracts that obligate them to data protection standards equivalent to ours. To preserve operational flexibility and protect commercially sensitive vendor relationships, the public list is presented by category. A current detailed list of sub-processors, including specific entity names, contact information, locations, and applicable privacy notices, is available within seven (7) business days of a written request to privacy@nourva.ai. Customers under signed Data Processing Agreements (DPAs) receive automatic notification of additions or material changes at least thirty (30) days in advance.

We will notify users at least 30 days before adding any new sub-processor that processes personal data, unless emergency security or legal compliance requires faster action.

Sub-Processor	Purpose	Location	Privacy
Third-Party AI Model Providers	Large language model inference, vision processing, embeddings, and related AI workloads	Multiple regions, worldwide	Detailed list available on request to privacy@nourva.ai
Cloud Infrastructure & Edge Network	Compute, storage, content delivery, DDoS protection, and edge serverless execution	Multiple regions, worldwide	Detailed list available on request to privacy@nourva.ai
Managed Database Hosting	Hosted PostgreSQL with point-in-time recovery and replication	Multiple regions, worldwide	Detailed list available on request to privacy@nourva.ai
Payment & Banking Processors	Card processing, subscription billing, payouts, and banking services for the operating entity	Multiple regions, worldwide (regulated providers)	Detailed list available on request to privacy@nourva.ai
App Store & In-App Purchase Processing	Processing subscriptions purchased inside the mobile apps, and reporting purchase, renewal, cancellation, and refund state back to the account	United States and worldwide	Apple: https://www.apple.com/legal/privacy · Google: https://policies.google.com/privacy
Mobile Push & Notification Transport	Delivering notifications to a mobile device where remote delivery is enabled; the transport receives an opaque device token and the message payload for delivery only	United States and worldwide	Detailed list available on request to privacy@nourva.ai
Search & Data Enrichment APIs	Live web search, page retrieval, and structured data enrichment for the Arachne web agent and Adam research workflows	Multiple regions, worldwide	Detailed list available on request to privacy@nourva.ai
Speech & Voice Services	Speech-to-text transcription of a voice turn, and text-to-speech synthesis of a spoken reply, for voice features	United States	Detailed list available on request to privacy@nourva.ai
Bot Protection & CAPTCHA	Telling a person from automated traffic at sign-up, sign-in and public forms; receives the challenge token the widget produced and the visitor's IP address	Multiple regions, worldwide (edge network)	Detailed list available on request to privacy@nourva.ai
Identity Verification (regulated provider)	Verifying the identity of an owner who asks for the verified mark on their public page: document and likeness checks run by a regulated provider, only at the owner's request	United States and European Union	Detailed list available on request to privacy@nourva.ai
Email & Notification Delivery	Transactional email, password resets, and account notifications	United States and European Union	Detailed list available on request to privacy@nourva.ai

Each sub-processor is bound by a written Data Processing Agreement (DPA) with Tokra, LLC that imposes data protection standards equivalent to ours. Cross-border transfers (e.g., to U.S. AI providers) rely on Standard Contractual Clauses (EU), the UK IDTA / Addendum, or other lawful mechanisms per Section 9.6.