Providers and Data Transfers

This register supports our Privacy Policy. It identifies the organisations that may receive personal data through nifdi, what they do, their relationship to us, where processing may take place and the safeguard used for restricted transfers.

Not every provider receives every user’s data. Paddle handles paid purchases, Google sign-in is used only if you choose to sign in with Google, Google Workspace receives correspondence only when someone writes to us, Google Fonts receives font requests when fonts load from Google’s servers, and PostHog receives analytics and marketing email data only as described in the Privacy Policy.

What the roles mean

• A processor handles personal data on Nifdi Systems Limited’s instructions where we are the controller.
• A subprocessor handles personal data on our instructions where we are processing it for a customer who is the controller.
• An independent controller decides for itself why and how it uses the data it receives and is responsible under its own privacy policy.

A provider’s role is assigned by processing activity rather than by company. The same provider may be our processor for personal data we control, our subprocessor for personal data in diagrams that a customer controls, and an independent controller for its own purposes such as account administration, fraud prevention or legal compliance.

Provider register

Provider	What it does and data involved	Relationship	Processing locations and transfer safeguard
Cloudflare	Provides edge request processing, content delivery and security filtering for the website and Service. It hosts the application on Workers and Durable Objects, stores account, entitlement and cloud-diagram records in D1 and backups of cloud diagrams in R2, holds the encryption keys for cloud diagrams, which are themselves stored encrypted, and produces request and security logs, including records of access to those keys. It also sends the Service’s email, such as the invitation to a person a diagram owner adds, which carries both people’s email addresses and the owner’s name, but not the diagram’s title or content.	Processor for data we control; subprocessor for personal data in diagrams that a customer controls.	Requests may be processed and decrypted at Cloudflare data centres worldwide, and stored records are not restricted to a region. For restricted transfers we rely on Cloudflare’s certification under the UK Extension to the EU-US Data Privacy Framework, with the UK Addendum to the EU Standard Contractual Clauses in its Customer DPA as a contractual fallback. Cloudflare’s subprocessors are listed on its published subprocessor page.
WorkOS	Provides sign-in, account and session management, and issues the sign-in tokens our service checks before it unlocks a diagram’s key. It receives account identifiers, email, optional name and session information. It holds no diagram content and no keys.	Processor.	United States. We rely on the UK Addendum to the EU Standard Contractual Clauses incorporated in its DPA.
Google sign-in	Lets you sign in with your Google account. It receives the sign-in request and returns your email address, name and Google account identifier to us through WorkOS.	Independent controller for its own sign-in service.	United States and Google’s global infrastructure. Google determines its own transfers and relies on its certification under the EU-US Data Privacy Framework and UK Extension, described in its data transfer framework information.
PostHog	Provides website statistics, product analytics and error reporting. It receives the statistics, analytics, device and technical error data described in the Privacy Policy. We configure PostHog and scrub URLs, free text and error payloads so that it does not receive diagram content. It also sends our marketing emails to people who have agreed to receive them. For this it receives their email address and, where they have agreed to email tracking, records when emails are opened and which links are clicked.	Processor.	Event data for the nifdi project is hosted on PostHog’s EU Cloud in Frankfurt, Germany (covered by UK adequacy regulations for the EEA). PostHog and its subprocessors may access data from outside the UK and EEA for support and operations; for those transfers we rely on the UK Addendum in PostHog’s executed DPA, and PostHog also participates in the UK Extension to the EU-US Data Privacy Framework.
Paddle	Acts as seller and Merchant of Record for paid subscriptions. Buyers provide payment details directly to Paddle at checkout, and Paddle handles tax, invoicing, refunds and transaction support under its own privacy notice. We share your account identifier and email address with Paddle to link a purchase to an account, and Paddle sends us limited subscription, country and transaction information. Card details do not reach nifdi.	Independent controller. Nifdi Systems Limited and Paddle each act as independent controllers for their own processing purposes.	Ireland, United Kingdom, United States and the locations of Paddle’s providers. Paddle independently determines its onward transfers and describes its safeguards in its Privacy Policy. For data we send to Paddle Payments Limited in Ireland, UK adequacy regulations for the EEA apply.
Google Workspace	Hosts our email, including privacy, support, billing, abuse and legal correspondence and any information a sender includes.	Processor.	United States and Google’s global infrastructure. We rely on Google’s certification under the UK Extension to the EU-US Data Privacy Framework, with the UK Addendum incorporated in Google’s Cloud Data Processing Addendum as a contractual fallback.
Google Fonts	Serves website and diagram fonts. A direct font request discloses request information such as IP address, browser details and the requested font to Google.	Independent controller for its handling of the request.	United States and Google’s global infrastructure. Google describes its reliance on adequacy arrangements including the EU-US Data Privacy Framework and UK Extension in its data transfer framework information.

Providers chosen by you

If you connect an AI agent or another integration that you choose, diagram content may be sent to its provider under that provider’s own terms and privacy policy. It is not a nifdi provider or subprocessor merely because you connect it to the Service. We remain responsible for the security and correct operation of our integration layer and for following your instructions. Business customers are responsible for ensuring they have a lawful basis and suitable arrangements with providers they select. Integrations that we select, embed or control are listed in the register above.

Changes and copies

We update this register when a provider or its role changes. If a change materially alters the categories of recipient, processing purpose, data location, transfer mechanism or privacy risk, we will notify account holders as described in the Privacy Policy. Business customers to whom our Data Processing Agreement applies will receive at least 30 days’ notice of a new subprocessor and may object as that agreement describes. Where that agreement permits, in a genuine security or service-continuity emergency we may engage a replacement subprocessor before the notice period ends; we will notify affected business customers as soon as possible and their objection rights will continue to apply.

Email privacy@nifdi.app if you want a copy of the contractual safeguard that applies to a particular transfer. We may redact commercially confidential information.