Subprocessors

Hosting: the Kubernetes cluster every app runs on, the Postgres databases on its disks, Cloud Storage for uploaded files and database backups, container builds and images, load balancing and TLS certificates, DNS, and application logs and uptime monitoring.

Everything stored in or passing through a hosted app: account, contact and content data, uploaded files, and request logs (IP address, user agent, requested path, errors).

United States, us-central1 (Iowa) for compute, databases, file storage, backups, builds and images. The load balancer terminates TLS at Google's global edge, and the application log bucket and DNS are Google global services.

Google Cloud Data Processing Addendum, which incorporate the EU Standard Contractual Clauses (with the UK and Swiss adaptations). Also listed under the EU-U.S. Data Privacy Framework according to its public listing; check current status at dataprivacyframework.gov.

Sends transactional email from hosted apps and the client portal (password resets, invitations, notifications and receipts), and carries NeateWorks' own email with clients.

Recipient names and email addresses and the content of each message.

Google's infrastructure (United States and other Google locations).

Google Workspace Cloud Data Processing Addendum, which incorporate the EU Standard Contractual Clauses (with the UK and Swiss adaptations). Also listed under the EU-U.S. Data Privacy Framework according to its public listing; check current status at dataprivacyframework.gov.

Where an app sends from the client's own Google Workspace domain, Google acts under the client's own agreement with Google, not as NeateWorks' subprocessor.

AI assistant NeateWorks personnel use to develop, support and operate the systems: it reads source code, support tasks and their comments, and application and infrastructure logs to diagnose and fix problems.

Personal data that happens to be in support tasks and comments, client contact names and email addresses in the portal, and application logs (IP addresses, request details, error messages). Credential-shaped text is redacted from logs before the assistant can read them.

United States.

Anthropic's commercial Data Processing Addendum, which incorporates the EU Standard Contractual Clauses.

Hosts source code and runs the automated tests and deployments for every app.

Source code and configuration. Personal data is not meant to be stored here. It can appear in the text of an issue, pull request or commit that describes support work. Automated tests run against temporary test databases, never production data.

United States.

GitHub Data Protection Agreement, which incorporate the EU Standard Contractual Clauses (with the UK and Swiss adaptations). Also listed under the EU-U.S. Data Privacy Framework according to its public listing; check current status at dataprivacyframework.gov.

AI features in a hosted app, where its Statement of Work includes them. NeateWorks also uses it to draft its own Insights articles, which contain no client data.

Generates text and images for the AI features of an app.

The prompt and response text an AI feature sends, which depends on the feature.

Vertex AI global endpoint. Google may serve a request from any of its regions.

Google Cloud Data Processing Addendum, which incorporate the EU Standard Contractual Clauses (with the UK and Swiss adaptations). Also listed under the EU-U.S. Data Privacy Framework according to its public listing; check current status at dataprivacyframework.gov.

Online payments in a hosted app that takes them (currently Bott Mobile Auto Care), and NeateWorks' own client invoices.

Payment processing on Stripe-hosted checkout and invoices.

Payer name, email address and phone number, line-item descriptions and amounts. Card details are entered on Stripe's hosted checkout or into Stripe's embedded payment fields and never reach NeateWorks' servers.

United States.

Stripe Data Processing Agreement, which incorporate the EU Standard Contractual Clauses (with the UK and Swiss adaptations). Also listed under the EU-U.S. Data Privacy Framework according to its public listing; check current status at dataprivacyframework.gov.

Bott Mobile Auto Care's booking and scheduling.

Turns a service address a customer types into a location (Geocoding API), and works out drive times and routes between booked appointments (Distance Matrix and Directions APIs).

The street address entered and the map coordinates of booked service locations.

Google's infrastructure (United States and other Google locations).

Google Maps Platform Data Processing Terms, which incorporate the EU Standard Contractual Clauses (with the UK and Swiss adaptations). Also listed under the EU-U.S. Data Privacy Framework according to its public listing; check current status at dataprivacyframework.gov.

The Bott Mobile Auto Care website, and NeateWorks' own website and client portal at neateworks.com.

Measures website traffic.

Pages viewed, browser and device details, approximate location derived from IP address, and a cookie identifier.

Google's infrastructure (United States and other Google locations).

Google Ads Data Processing Terms, which incorporate the EU Standard Contractual Clauses (with the UK and Swiss adaptations). Also listed under the EU-U.S. Data Privacy Framework according to its public listing; check current status at dataprivacyframework.gov.