NetQnect Subprocessors

Version date: 16 September 2026.

Effective date: 16 September 2026, applying only when this exact revision is published.

Contact: legal@netqnect.com

1. About This List

This list identifies providers used by NetQnect. A hosting vendor acting on our instructions is a processor; a user-connected platform may be an independent controller. Self-hosted software is not a separate recipient merely because NetQnect uses it. The headings distinguish those roles; a provider named here is not automatically enabled.

Optional integrations are included only where they are enabled for a user, organiser or workspace.

NetQnect's provider-selection policy is to host and process personal data using United Kingdom (London-region) and European Union infrastructure and providers wherever possible, including for AI and embedding processing. Any provider that cannot currently meet this policy is documented below, together with the reason and its safeguards.

2. Core Infrastructure

Google Cloud Platform and Firebase

• Purpose: hosting, authentication, databases, cloud functions, storage, messaging, app security, crash reporting, performance monitoring and analytics where enabled.
• Data: account, profile, event, connection, message, usage, diagnostics, token, notification and security data.
• Location: Firestore, Cloud Storage, Cloud Functions (Gen 2) and Pub/Sub message storage use europe-west2 (London), in line with NetQnect's UK/EU hosting policy. Firebase Authentication processes data in the United States. Other nonregional Firebase services may use global infrastructure. See Firebase location information.
• Safeguards: this processing is governed by the Google Cloud/Firebase Data Processing Addendum, Google Cloud's published subprocessor list, applicable Standard Contractual Clauses and the UK transfer addendum, Google's security measures, NetQnect's data-deletion tooling and Google's Data Incident Response process.

IONOS Server Infrastructure

• Purpose: backend hosting for the AI Assistant, background task processing, queues, caching and supporting databases operated outside NetQnect's primary Google Cloud/Firebase platform.
• Data: assistant messages, tool-call records, task context, operational logs, diagnostic traces and related operational metadata.
• Location: IONOS-hosted servers in the United Kingdom.
• Safeguards: IONOS's data-processing terms apply to hosting. Access-restricted IONOS/Acronis recovery copies are held through the European backup service and excluded from ordinary use. Their maximum retention is 60 days; native host copies are limited to 14 days. Deletion and restriction instructions are reapplied before restored copies are used. These recovery copies are distinct from the active service databases.

3. AI And Embeddings

Google Gemini on Vertex AI (Gemini Enterprise Agent Platform)

• Purpose: assistant/model inference as services move from Nebius, and existing embedding generation for profile, event, team/business and capability search workflows.
• Data: necessary prompts and messages, authorised profile/relationship/event context, embedding input text, outputs/vectors and technical metadata.
• Location: Gemini 3.8 Flash inference uses the EU multi-region (eu); embeddings use London (europe-west2). NetQnect does not use a global endpoint for this processing. Regional commitments cover the service's documented data-at-rest and machine-learning processing scope; connected services and provider operational data have their own location terms.
• Safeguards: the Google Cloud Data Processing Addendum and applicable contractual transfer safeguards apply. Google's training restriction prohibits training or fine-tuning with customer data without prior permission or instruction. Limited provider caching and security/abuse-monitoring retention can apply; NetQnect does not describe this as zero retention. Optional grounding, request-response logging and model tuning are not enabled for this service.

Nebius Token Factory — September 2026 transition

Nebius continues to supply assistant inference for services that have not yet switched to Vertex AI. It processes necessary prompts, assistant messages, profile, relationship and event context, outputs and technical metadata. Processing location depends on the selected model and endpoint; we do not describe Nebius as UK/EU-only processing. Its Data Processing Agreement, incorporated into its Terms of Service, and applicable Standard Contractual Clauses and UK Addendum govern this processing and residual historical data. The account's inference retention and model-training controls remain separate assurances.

We are replacing Nebius before the UK public launch. After the remaining services have switched, Nebius will be recorded as a former provider; we will revoke its keys and pursue deletion of remaining provider-held data under its DPA. This entry does not claim that the transition or provider deletion is already complete. Historical accounting and disposal evidence is kept separately from active assistant content.

Self-hosted Neo4j vector storage and search

• Purpose: vector storage and similarity search for profile, event, team, capability, recommendation and matching features.
• Data: embeddings, embedding metadata, profile/event/team identifiers, similarity-search metadata and technical metadata.
• Location: NetQnect's vector store is self-hosted Neo4j on the IONOS graph host in the United Kingdom.
• Safeguards: this processing is covered by the IONOS hosting safeguards above, together with NetQnect-controlled vector deletion, exclusion and rebuild procedures. Privacy and incident enquiries can be sent to legal@netqnect.com.

4. Analytics, Diagnostics And Monitoring

Google Analytics

• Purpose: website and app analytics, used only after a user has given consent.
• Data: cookie or device identifiers, page views, events, approximate location, browser and device information.
• Location: Google collects EU, Swiss and UK traffic through regional domains and servers and discards individual IP addresses before logging, then forwards measurement traffic to Google Analytics infrastructure for processing. Google Analytics uses global infrastructure and international transfers may occur; NetQnect does not describe this service as EU-only processing.
• Safeguards: this processing is governed by Google Analytics' data-processing terms, applicable Standard Contractual Clauses and Google's EU-U.S. Data Privacy Framework certification. Analytics is off by default and is enabled only under the applicable user consent and configured service controls.

Firebase Crashlytics and Firebase Performance Monitoring

• Purpose: crash reports, app diagnostics and performance monitoring.
• Data: device, app, diagnostic, event and performance data.
• Location: Firebase/Google processing locations depending on service and configured project.
• Safeguards: this processing is governed by Firebase/Google's data-processing terms, Firebase's privacy and security controls, and NetQnect's app privacy settings. Crashlytics is gated behind user consent. Performance Monitoring follows the app's diagnostic consent controls and the provider retention periods described in the Data Retention Schedule.

5. Payments And Billing

Stripe

• Purpose: paid plans, payments, invoices, billing, tax and subscription administration.
• Data: billing contact details, payment identifiers, subscription status, invoice data and transaction metadata.
• Location: Stripe and its affiliates and subprocessors process data globally, as described in Stripe's terms.
• Safeguards: this processing is governed by the Stripe Data Processing Agreement, which forms part of and applies automatically under the Stripe Services Agreement that every Stripe account accepts, together with Stripe's data-transfer addendum, published subprocessor list and payment-security controls. The current service launches free; payment processing applies only if a paid service is offered and selected.

6. Connected Services

Connected services are optional and process data only where the relevant integration is enabled and authorised by the user, organiser or workspace. Google Calendar and Microsoft Calendar are explicit user-activated connections; a user must select a provider, complete its OAuth flow and enable the relevant capability themselves. NetQnect does not create a calendar connection from sign-in, profile data or another user's request. GitHub and LinkedIn are not available at launch.

Google Calendar

• Purpose: optional calendar availability checks, selected-calendar metadata and confirmed NetQnect meeting write-back where the user enables the relevant capability.
• Data: Google account label, OAuth token records, selected calendar id/label metadata, bounded free/busy availability results, calendar capability preferences, consent records, sync logs and NetQnect-created provider event references. NetQnect does not import full calendar history or event content for availability checks.
• Location: Google processes this data under the user's own Google account and Google's API terms. Google does not offer a Data Processing Agreement for third-party access to consumer Calendar data accessed by OAuth; NetQnect is the controller for the calendar data it retrieves and stores, and is contractually responsible under the Google API Services User Data Policy for how that data is used, secured and deleted.
• Safeguards: this connection is governed by the Google API Services User Data Policy, minimum-scope OAuth access, contextual user consent, encrypted local token storage, and NetQnect's disconnect, export and deletion controls. Provider access restrictions and the permissions you grant apply to each connection.

Microsoft Calendar

• Purpose: optional Microsoft Graph calendar availability checks, selected-calendar metadata and confirmed NetQnect meeting write-back where the user enables the relevant capability.
• Data: Microsoft account label, OAuth token records, selected calendar id/label metadata, bounded schedule/free-busy availability results, calendar capability preferences, consent records, sync logs and NetQnect-created provider event references. NetQnect does not import full calendar history or event content for availability checks.
• Location: Microsoft processes this data under the user's own Microsoft account and Microsoft's API terms. Microsoft's identity platform Terms of Use expressly state that no joint-controller or processor/sub-processor relationship is created between Microsoft and NetQnect; NetQnect is the controller for the calendar data it retrieves and stores, and is contractually responsible for its own consent, retention and deletion practices.
• Safeguards: this connection is governed by Microsoft's APIs Terms of Use, least-privilege delegated calendar permissions, contextual user consent, encrypted local token storage, and NetQnect's disconnect, export and deletion controls. NetQnect's Calendar connection supports personal Microsoft accounts.

Eventbrite

• Purpose: event import, organiser workflows, attendee matching and check-in, where an organiser or user enables the connection.
• Data: event, organiser, attendee, ticket, claim and platform reference data.
• Location: Eventbrite's standard processing locations under its published terms.
• Safeguards: this integration is governed by Eventbrite's legal terms, its organiser Data Processing Agreement and API Terms of Use, together with user or organiser authorisation and NetQnect's disconnect and import-deletion controls.

7. Communications And Support

Firebase Trigger Email and self-hosted Postfix

• Purpose and data: transactional service messages, delivery status and associated contact/notification metadata.
• Location and terms: the Firebase extension and queue operate in London; Postfix operates on the UK IONOS VPS. Google/Firebase and IONOS terms apply to their respective services.

Porkbun forwarding and Microsoft Hotmail / Outlook.com consumer mail

• Purpose and data: legal@netqnect.com forwards through Porkbun to the business owner's consumer Hotmail/Outlook.com inbox for support and privacy correspondence, including email addresses, message content and attachments.
• Location: Microsoft may process mail in the United States and other countries outside the UK/EU; the consumer mailbox has no promised UK/EU-only residency.
• Terms and safeguards: Porkbun forwarding terms and the Microsoft Services Agreement and Privacy Statement apply. This is consumer mail, not Microsoft 365 business processing under an enterprise DPA. Microsoft's published transfer safeguards include its UK Extension to the EU–US Data Privacy Framework for eligible US transfers and standard contractual clauses where applicable. Please send only information needed to handle your enquiry.

8. Review And Recipient Information

This list distinguishes service providers acting on our instructions from independent connected-service and consumer-mail providers. Their own terms also apply. Disabled OpenAI, GitHub and LinkedIn integrations are not current service recipients.

Ask legal@netqnect.com for information about applicable recipients or a copy of relevant transfer safeguards, with confidential details protected where necessary.

9. Change Notice

NetQnect updates this list before adding a new subprocessor that materially changes how personal data is processed.

Last substantive update: 16 September 2026. Added EU Gemini inference, the Nebius transition, revised recovery limits and the confirmed consumer-mail forwarding arrangement.

We do not use your data to train AI models. If we ever propose an optional programme, we will explain it in Privacy Settings and ask you first.