Providers, Processors and Infrastructure

Not every provider has the same legal role. The list below identifies the providers used by EZINDRA, the purpose for which their services are used, the basic scope of data and their principal role in the relevant processing.

A provider's role may depend on the type of data and the specific service. EZINDRA discloses data only to the extent necessary for the relevant function.

Supabase provides data and file hosting, authentication and backend functions. It may process account data and data and files entered by the user into EZINDRA. Role: processor for data for which EZINDRA is the controller; where EZINDRA processes data on behalf of a customer, Supabase acts as a subprocessor.

Netlify hosts the application and handles traffic to EZINDRA. It may process technical data and data transmitted in requests to the extent necessary to operate the application. Role: processor for data processed on EZINDRA's instructions; where EZINDRA acts as a processor, Netlify may act as a subprocessor.

Resend is used to send email. It may process email addresses, message content and technical data related to delivery. Role: processor; for data entrusted to EZINDRA by a customer, it may act as a subprocessor.

Paddle handles payments and subscriptions and may process buyer and transaction data needed to process payments, taxes and subscriptions. Card details are provided directly to Paddle or its payment providers; EZINDRA does not store payment card numbers. Paddle acts as Merchant of Record and as an independent controller for its own processing of buyer and transaction data.

If a user chooses Google Sign-In, Google processes data needed for authentication and provides identity data required to create or link the EZINDRA account. Role: Google acts as an independent controller for processing carried out within the Google account and Google services.

After consent, PostHog may process application-usage data and technical data for analytics and diagnostics, including session-replay data where that feature is active. It may also receive a pseudonymous EZINDRA account identifier used to link analytics events across sessions and support error diagnostics; EZINDRA does not provide the account email address, client data or form/quote contents for this purpose. Role: PostHog acts as a processor for EZINDRA analytics data.

After consent, Google Analytics 4 may process data about use of EZINDRA's public pages and technical and measurement data needed for traffic analytics. In EZINDRA's current configuration, the Google services data-sharing setting is disabled; in this scope Google Analytics acts as a processor.

Google Gemini API is used to generate EZINDRA AI Support responses. The user's message content and the conversation and application-use context necessary to provide the response are sent to Google. For users in the EEA, Google acts as a processor for prompts and responses under the terms applicable there; Google processes certain technical and service data as an independent controller.

Cloudflare Turnstile protects selected forms and operations against bots and abuse. It may process, among other things, the IP address, TLS connection information, the User-Agent header and data identifying the protected site. Cloudflare acts as a processor when it uses these signals to protect EZINDRA and as an independent controller when it uses them to improve bot detection.

The list below reflects EZINDRA's current configuration and providers' published information. For globally distributed services, principal countries or regions are stated where listing every location is not practicable. The list is updated after a material infrastructure change or relevant provider update.

• Supabase — EZINDRA's primary project data is stored in Germany (Frankfurt, EEA), in eu-central-1. Supporting operations, support and Supabase subprocessors may involve processing in other countries, including the United States and Singapore, in accordance with Supabase's current disclosures.
• Netlify — United States and locations across its global edge network. Application traffic may be handled at a network node close to the user, and Netlify may process data outside the country of collection through affiliates and service providers.
• Resend — United States. Resend states that customer data is stored in the United States.
• Paddle — United Kingdom, United States, Canada and Ireland in connection with Paddle group entities; further processing may occur in other countries through Paddle's service providers.
• Google Sign-In — Google operates global infrastructure; sign-in data may be processed outside the user's country, including in the EEA and the United States, in accordance with Google's policies.
• Google Analytics 4 — Google operates global infrastructure; measurement data may be processed outside the user's country, including in the EEA and the United States. In the current configuration, the Google services data-sharing setting is disabled.
• Google Gemini API — Google operates global infrastructure. Data needed to process a request may be processed, temporarily stored or cached in countries where Google or its providers maintain infrastructure, under the terms applicable to the service.
• PostHog EU Cloud — Germany (Frankfurt, EEA). EZINDRA uses the EU Cloud regional endpoint; PostHog states that data for this instance is hosted on EU-based infrastructure.
• Cloudflare Turnstile — Cloudflare's global network spans data centres in more than 100 countries. Technical verification data may be handled at network locations relevant to the user's connection and according to the Cloudflare service configuration.

Where personal data is transferred to a country for which additional safeguards are required, the transfer is based on a mechanism permitted by applicable law, including an adequacy decision, Standard Contractual Clauses or another legally permitted safeguard. Depending on the provider, the mechanism may arise from the agreement or DPA with the provider and may cover further recipients in its processing chain.

Information about the applicable transfer mechanism and safeguards and, where applicable, a copy of the relevant safeguards or information about where they are available may be requested at contact@ezindra.com.