Nubo SuiteWhat this list is
Companies that process customer data on our behalf. We will update this page, and tell business customers by email at least 30 days ahead, before adding or replacing one, as the Data Processing Addendum says.
Infrastructure hosting
Hetzner (Hetzner Online GmbH, Germany). Purpose: servers, databases and file storage (Hetzner Cloud and Object Storage), including the storage for mail. Location: Helsinki, Finland. All mail, files and databases are in this one location.
Edge network, DNS and bot protection
Cloudflare (Cloudflare, Inc., United States, with servers worldwide). Purpose: DNS, content delivery and protection of the website, and Cloudflare Turnstile on website forms. Cloudflare sees the IP address, the page requested and the browser type of visitors.
AI features
DeepInfra (DeepInfra Inc., United States), through Nubo’s own AI gateway. Purpose: running the AI model for AI features, only when a person uses an AI feature. The text and any content sent with that request are processed by DeepInfra; we do not send your name or account details with it. DeepInfra is a US company and we have not confirmed in which countries its servers run or how long it keeps request data, so do not send content through AI features that you are not willing to have processed in the United States. Organisations that cannot accept this should not use the AI features.
Payments
These are used when you pay for a paid plan. The Free plan involves no payment provider.
- Razorpay (India). Purpose: card, UPI and netbanking payments in INR for customers billed in India.
- Dodo Payments (merchant of record, outside India). Purpose: card and local payments for customers billed outside India, including collecting and remitting sales tax or VAT.
We do not store full card numbers.
Email delivery
Nubo runs its own mail servers for @nubo.email and for system mail from noreply@nubo.email, on the hosting above. We do not use an outside email relay or bulk-mail service.
Calls
Meetings and calls connect peer to peer where they can. When they cannot, media is relayed through a TURN server (coturn) that Nubo runs itself on the hosting above; no outside relay is used.
Push notifications
Browser push is delivered through the push service run by your browser vendor (for example Google, Mozilla or Apple). Push messages are encrypted to your browser, so the push service sees the endpoint, the size and the timing but not the content.
Website analytics
Microsoft Corporation (Microsoft Clarity), loaded from clarity.ms on this website (not inside the Nubo apps). Purpose: heatmaps and anonymised session recordings of visits to the marketing website, with form fields masked. It loads only as described in the Cookie policy (after you accept, if you are on the UK version or in a European time zone; never if your browser sends Global Privacy Control or Do Not Track). Microsoft states that Clarity operates as a data controller for this data and keeps recordings for 30 days. Where Microsoft stores it is described in the Microsoft Privacy Statement; we have not independently confirmed the location.
Google LLC (Google Analytics, and Google Tag Manager where it is used to load it), loaded from googletagmanager.com on this website (not inside the Nubo apps). Purpose: statistics on page views, clicks and form submissions on the marketing website, with no advertising use (advertising storage and personalisation are denied, Google signals are off). It loads only as described in the Cookie policy (after you accept, if you are on the UK version or in a European time zone; never if your browser sends Global Privacy Control or Do Not Track). We use Google as a processor for this measurement data under the data processing terms Google offers for Google Analytics, which we accept in the Google Analytics account; we have not independently verified which Google terms document applies to our configuration or where Google stores the data, so check Google’s own pages. Event data is kept for 14 months.
Ahrefs (Ahrefs Web Analytics), loaded from analytics.ahrefs.com on this website only. Purpose: cookie-free visit statistics (page address, referrer, user-agent text). It follows the same consent logic as the services above. Ahrefs describes the service in its Web Analytics help pages and privacy policy; we have not independently confirmed where Ahrefs processes the data.
Not used
This website runs no advertising or error-monitoring service from a third party.