NetQnect Subprocessors

Draft status: for legal review before publication.

Effective date: 2026-05-03

Contact: legal@netqnect.com

1. About This List

This list explains the main third-party providers and provider categories that may process personal data for NetQnect.

The production provider list, regions, contracts, data-processing agreements and transfer safeguards must be confirmed before publication. Optional integrations are included only where they are enabled for a user, organiser or workspace.

NetQnect's provider-selection policy is to host and process personal data using United Kingdom (London-region) and European Union infrastructure and providers wherever possible, including for AI and embedding processing. Any provider that cannot currently meet this policy is documented below, together with the reason and its safeguards.

2. Core Infrastructure

Google Cloud Platform and Firebase

• Purpose: hosting, authentication, databases, cloud functions, storage, messaging, app security, crash reporting, performance monitoring and analytics where enabled.
• Data: account, profile, event, connection, message, usage, diagnostics, token, notification and security data.
• Location: production Firestore, Cloud Storage, Cloud Functions (Gen 2) and Pub/Sub message storage are locked to europe-west2 (London) across development, staging and production, in line with NetQnect's UK/EU hosting policy. Some Firebase platform services, such as Authentication and certain global control-plane functions, run on global Google infrastructure or service-specific locations outside europe-west2 because Google does not offer regional selection for them.
• Safeguards: this processing is governed by the Google Cloud/Firebase Data Processing Addendum, Google Cloud's published subprocessor list, applicable Standard Contractual Clauses and the UK transfer addendum, Google's security measures, NetQnect's data-deletion tooling and Google's Data Incident Response process.

IONOS Server Infrastructure

• Purpose: backend hosting for the AI Assistant, background task processing, queues, caching and supporting databases operated outside NetQnect's primary Google Cloud/Firebase platform.
• Data: assistant messages, tool-call records, task context, operational logs, diagnostic traces and related operational metadata.
• Location: IONOS-hosted servers in the United Kingdom.
• Safeguards: this processing is governed by IONOS's data-processing terms under its General Terms and Conditions. IONOS hosts in geo-redundant, ISO 27001-certified data centres and publishes an availability commitment of at least 99.9% for its cloud infrastructure. NetQnect uses the IONOS Flex Backup service, which applies AES-256 server-side encryption by default; NetQnect's chosen retention window and incident-escalation contact are being confirmed as part of NetQnect's launch review.

3. AI And Embeddings

Nebius Token Factory

• Purpose: AI model calls for the AI Assistant, relationship-memory and generated-content processing.
• Data: prompts, assistant messages, profile text, relationship context, event context and technical metadata, depending on the feature.
• Location: NetQnect's launch models run in Nebius Token Factory's eu-north1 (EU) region.
• Safeguards: this processing is governed by the Nebius Data Processing Agreement, incorporated into the Nebius Terms of Service, together with Standard Contractual Clauses and the UK Addendum for applicable transfers. Zero data retention is enabled, so prompts and outputs are not used to train Nebius's models. Nebius publishes its subprocessor list and maintains security and certification evidence. NetQnect does not use Nebius's Data Lab, post-training, fine-tuning or uploaded-dataset features for personal data.

Google Cloud Gemini Enterprise Agent Platform

• Purpose: embedding generation for profile, event, team/business and capability vector workflows.
• Data: embedding input text, profile context, event context, team/business context, capability context, returned vectors and technical metadata, depending on the feature.
• Location: embedding generation runs in Google Cloud's europe-west2 (London) region across development, staging and production; the global endpoint is not used for personal data.
• Safeguards: this processing is governed by the Google Cloud Data Processing Addendum, applicable Standard Contractual Clauses, and Google Cloud's AI/ML no-training restriction. Request-response logging, grounding, session resumption and model tuning or training are not enabled for personal-data embeddings.

Self-hosted Neo4j vector storage and search

• Purpose: vector storage and similarity search for profile, event, team, capability, recommendation and matching features.
• Data: embeddings, embedding metadata, profile/event/team identifiers, similarity-search metadata and technical metadata.
• Location: NetQnect's vector store is self-hosted Neo4j on the IONOS graph host in the United Kingdom.
• Safeguards: this processing is covered by the IONOS hosting safeguards above, together with NetQnect-controlled vector deletion, exclusion and rebuild procedures. The incident-escalation route for the graph host is being finalised as part of NetQnect's launch review.

4. Analytics, Diagnostics And Monitoring

Google Analytics

• Purpose: website and app analytics, used only after a user has given consent.
• Data: cookie or device identifiers, page views, events, approximate location, browser and device information.
• Location: Google Analytics processes data on Google's global infrastructure by default; Google offers an EU Data Boundary configuration that restricts processing of European traffic to EU infrastructure, which NetQnect must enable to meet its UK/EU hosting policy before Analytics is switched on.
• Safeguards: this processing is governed by Google Analytics' data-processing terms and Google's EU-U.S. Data Privacy Framework certification for any data that is not kept within the EU Data Boundary. Analytics stays disabled until consent is captured, and remains off entirely until NetQnect enables it for launch.

Firebase Crashlytics and Firebase Performance Monitoring

• Purpose: crash reports, app diagnostics and performance monitoring.
• Data: device, app, diagnostic, event and performance data.
• Location: Firebase/Google processing locations depending on service and configured project.
• Safeguards: this processing is governed by Firebase/Google's data-processing terms, Firebase's privacy and security controls, and NetQnect's app privacy settings. Crashlytics is gated behind user consent. Firebase Performance Monitoring's pre-consent behaviour is being corrected to the same consent gate before launch.

5. Payments And Billing

Stripe

• Purpose: paid plans, payments, invoices, billing, tax and subscription administration.
• Data: billing contact details, payment identifiers, subscription status, invoice data and transaction metadata.
• Location: Stripe and its affiliates and subprocessors process data globally, as described in Stripe's terms.
• Safeguards: this processing is governed by the Stripe Data Processing Agreement, which forms part of and applies automatically under the Stripe Services Agreement that every Stripe account accepts, together with Stripe's data-transfer addendum, published subprocessor list and payment-security controls. Paid plans remain disabled until NetQnect's financial-record retention exceptions are finalised.

6. Connected Services

Connected services are optional and process data only where the relevant integration is enabled and authorised by the user, organiser or workspace. Google Calendar and Microsoft Calendar are explicit user-activated connections planned for the production release; a user must select a provider, complete its OAuth flow and enable the relevant capability themselves. NetQnect does not create a calendar connection from sign-in, profile data or another user's request. GitHub and LinkedIn are not available at launch.

Google Calendar

• Purpose: optional calendar availability checks, selected-calendar metadata and confirmed NetQnect meeting write-back where the user enables the relevant capability.
• Data: Google account label, OAuth token records, selected calendar id/label metadata, bounded free/busy availability results, calendar capability preferences, consent records, sync logs and NetQnect-created provider event references. NetQnect does not import full calendar history or event content for availability checks.
• Location: Google processes this data under the user's own Google account and Google's API terms. Google does not offer a Data Processing Agreement for third-party access to consumer Calendar data accessed by OAuth; NetQnect is the controller for the calendar data it retrieves and stores, and is contractually responsible under the Google API Services User Data Policy for how that data is used, secured and deleted.
• Safeguards: this connection is governed by the Google API Services User Data Policy, minimum-scope OAuth access, contextual user consent, encrypted local token storage, and NetQnect's disconnect, export and deletion controls. Google classifies Calendar scopes as sensitive, so an app must complete Google's OAuth verification before it can serve more than 100 users; until NetQnect's Google Cloud OAuth application has completed that verification, Calendar cannot be offered beyond a small test group. NetQnect's verification status is being confirmed as part of NetQnect's launch review.

Microsoft Calendar

• Purpose: optional Microsoft Graph calendar availability checks, selected-calendar metadata and confirmed NetQnect meeting write-back where the user enables the relevant capability.
• Data: Microsoft account label, OAuth token records, selected calendar id/label metadata, bounded schedule/free-busy availability results, calendar capability preferences, consent records, sync logs and NetQnect-created provider event references. NetQnect does not import full calendar history or event content for availability checks.
• Location: Microsoft processes this data under the user's own Microsoft account and Microsoft's API terms. Microsoft's identity platform Terms of Use expressly state that no joint-controller or processor/sub-processor relationship is created between Microsoft and NetQnect; NetQnect is the controller for the calendar data it retrieves and stores, and is contractually responsible for its own consent, retention and deletion practices.
• Safeguards: this connection is governed by Microsoft's APIs Terms of Use, least-privilege delegated calendar permissions, contextual user consent, encrypted local token storage, and NetQnect's disconnect, export and deletion controls. Microsoft's publisher verification programme does not apply to apps that use personal Microsoft accounts, which is the account type NetQnect's Calendar connection uses, so it is not a launch gate for this integration.

Eventbrite

• Purpose: event import, organiser workflows, attendee matching and check-in, where an organiser or user enables the connection.
• Data: event, organiser, attendee, ticket, claim and platform reference data.
• Location: Eventbrite's standard processing locations under its published terms.
• Safeguards: this integration is governed by Eventbrite's legal terms, its organiser Data Processing Agreement and API Terms of Use, together with user or organiser authorisation and NetQnect's disconnect and import-deletion controls.

7. Communications And Support

Firebase Trigger Email, self-hosted Postfix, Porkbun forwarding and support mailbox providers

• Purpose: transactional email, support messages, product notices and service communications.
• Data: name, email address, message content, notification tokens, delivery status and support metadata.
• Location: the Firebase Trigger Email extension and its Firestore queue run in europe-west2 (London); Postfix runs on the IONOS VPS in the United Kingdom; Porkbun provides forwarding for domain addresses. The destination support mailbox's own region and provider are being confirmed.
• Safeguards: this processing is governed by Google/Firebase's terms, IONOS's terms, Porkbun's privacy and forwarding terms, and Postfix's operational controls. Mail sent to legal@netqnect.com is currently forwarded to a third-party mailbox on an interim basis while NetQnect migrates to a DPA-backed business mailbox provider.

8. Change Notice

NetQnect updates this list before adding a new subprocessor that materially changes how personal data is processed.

Last substantive update (2026-07-17): confirmed the europe-west2 (London) regional lock for core Firestore, Cloud Storage, Cloud Functions and Pub/Sub data; removed Milvus and Zilliz, which are not used; added Google Calendar and Microsoft Calendar as optional, user-activated connected services selected for the planned production release; and clarified provider safeguards using each provider's published terms, including that Google's OAuth verification (not Microsoft's publisher verification, which does not apply to personal-account apps) is the real launch gate for Calendar.