Subprocessors
Last updated
Like most online services, Nabu Science relies on a small number of third-party providers (“subprocessors”) to deliver the service — for example to host the application, store data, parse and evaluate papers, send email, and understand how the product is used. This page discloses the categories of recipients we share data with, what data each category receives, why, and where it is processed.
1. Overview
We share with each subprocessor only the data it needs to perform its function, and we do not sell your personal data. Each subprocessor is bound by a data processing agreement that meets the requirements of Article 28 of the GDPR. Where a subprocessor processes data in the United States, the transfer is protected by the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses, as described in the Privacy Policy.
2. Categories of recipients
| Category | What data | Purpose | Location & transfer |
|---|---|---|---|
| AI model providers | Paper text and metadata | AI evaluation of papers | United States; EU–US Data Privacy Framework and/or SCCs |
| Document parsing | Uploaded PDF files | Parsing PDFs into text | United States (or EU region); SCCs |
| Cloud infrastructure & database | Account data, uploaded PDFs, paper metadata, evaluation outputs, your library, audit events, server logs | Hosting, database, authentication, file storage | United States / global edge; DPF and/or SCCs |
| Transactional email | Your email address and the content of emails we send | Sign-in links and notifications | United States; SCCs |
| Error monitoring | Diagnostic data, which may include user identifiers | Detecting and fixing errors | United States; DPF and/or SCCs |
| Product analytics | Product usage events linked to your user ID and email when signed in, plus device/browser metadata | Understanding product usage | European Union (Frankfurt) |
| Network security & content delivery | IP addresses and request metadata | Security, DNS, CDN | United States / global; DPF and/or SCCs |
| Virus scanning | Uploaded PDF files | Scanning uploads | Self-hosted on our own infrastructure — no third party receives this data |
The specific named subprocessors behind each category — including the signed data processing agreements and transfer details — are available on request at privacy@nabu.science, and to procurement and security teams under NDA.
3. Changes and notifications
We update this page within 30 days of adding, removing, or materially changing a subprocessor. If you have questions about any subprocessor, or want to be notified of changes to this list, contact us at privacy@nabu.science.