Providers and Data Transfers

This register supports our Privacy Policy. It identifies the organisations that may receive personal data through nifdi, what they do, their relationship to us, where processing may take place and the safeguard used for transfers outside the United Kingdom.

Not every provider receives every user’s data. Paddle handles paid purchases, Google Workspace receives correspondence only when someone writes to us, and PostHog receives analytics only as described in the Privacy Policy.

What the roles mean

• A processor handles personal data on Nifdi Systems Limited’s instructions where we are the controller.
• A subprocessor handles personal data on our instructions where we are processing it for a customer who is the controller.
• An independent controller decides for itself why and how it uses the data it receives and is responsible under its own privacy policy.

The same infrastructure provider may be our processor for personal data we control and our subprocessor for personal data in diagrams that a customer controls.

Provider register

Provider	What it does and data involved	Relationship	Processing locations and transfer safeguard
Cloudflare	Hosts the website and Service, delivers content, stores account, entitlement and cloud-diagram records, and produces request and security logs.	Processor for data we control; subprocessor for personal data in diagrams that a customer controls.	Global network. Its Customer DPA incorporates the EU Standard Contractual Clauses and UK Addendum for restricted transfers; adequacy mechanisms may also apply.
WorkOS	Provides sign-in, account and session management, and protected key management. It receives account identifiers, email, optional name, session information and key-related records.	Processor for account data; subprocessor where its service handles records connected with diagrams that a customer controls.	United States. Its DPA incorporates the EU Standard Contractual Clauses and UK Addendum.
PostHog	Provides website statistics, product analytics and error reporting. It receives the statistics, analytics, device and technical error data described in the Privacy Policy, but not diagram content.	Processor.	The nifdi project uses PostHog’s EU Cloud in Frankfurt, Germany. PostHog’s DPA incorporates the EU Standard Contractual Clauses and UK Addendum for onward restricted transfers; PostHog also participates in relevant Data Privacy Framework programmes.
Paddle	Acts as seller and Merchant of Record for paid subscriptions, handling payment details, tax, invoicing, refunds and transaction support. It sends us limited subscription, country and transaction information. Card details do not reach nifdi.	Independent controller for the purchase.	Ireland, United Kingdom, United States and the locations of Paddle’s providers. Paddle describes its transfer safeguards, including the EU Standard Contractual Clauses and UK Addendum, in its Privacy Policy.
Google Workspace	Hosts our email, including privacy, support, billing, abuse and legal correspondence and any information a sender includes.	Processor.	United States and Google’s global infrastructure. Google’s Cloud Data Processing Addendum incorporates its Standard Contractual Clauses and UK Addendum; relevant adequacy mechanisms may also apply.
Google Fonts	Serves website and diagram fonts. A direct font request discloses request information such as IP address, browser details and the requested font to Google.	Independent controller for its handling of the request.	United States and Google’s global infrastructure. Google describes its reliance on adequacy arrangements including the EU-US Data Privacy Framework and UK Extension in its data transfer framework information.

Providers chosen by you

If you connect an AI agent or another integration, diagram content may be sent to the provider you choose under its terms and privacy policy. It is not a nifdi provider or subprocessor merely because you connect it to the Service.

Changes and copies

We update this register when a provider or its role changes. If a change materially affects your rights, we will notify account holders as described in the Privacy Policy.

Email privacy@nifdi.app if you want a copy of the contractual safeguard that applies to a particular transfer.