Subprocessors
1. Overview
Noxart Games Co. (“Noxtica”, “we”, “our” or “us”) uses third-party service providers (“Subprocessors”) to help deliver the Services. This page lists them, what they do, and where they process data. It forms part of our Data Processing Addendum (“DPA”).
By using the Services, customers authorise us to engage the Subprocessors listed below, and new Subprocessors in accordance with Section 6 and the DPA.
2. Infrastructure Operated by Noxtica
Some processing takes place on infrastructure that Noxtica itself operates. This is not a Subprocessor, but we list it for transparency:
| Infrastructure | Purpose | Data processed | Location |
|---|---|---|---|
| Noxtica-operated servers (OpenStack) | Primary PostgreSQL database; ingestion services | Account data, tenant configuration, event and signal data, verification records and audit logs | Antalya, Türkiye |
| Noxtica-operated GPU servers | Verification model inference (document reading, face comparison, liveness and voice checks) | Verification images, frames and voice samples, processed transiently | Noxtica-operated facilities, connected through Cloudflare secure tunnels |
3. Current Subprocessors
3.1 Core Infrastructure (always used)
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Cloudflare, Inc. | Content delivery, edge compute (Workers, Pages), databases and storage (D1, KV, R2, Durable Objects, Queues, Hyperdrive), analytics (Analytics Engine, Web Analytics), secure tunnels and access control, security services (WAF, DDoS, bot management, rate limiting), transactional email, speech transcription (Workers AI, when enabled) | All categories of service data, including device signals, monitoring data, verification evidence (encrypted before storage), account data and email content | Global edge network; verification evidence and backups stored in Europe |
| Google LLC (Google Cloud) | Data warehouse (BigQuery) and staging storage (Cloud Storage) | Minimised, tenant-scoped event, monitoring and audit records | European Union (Warsaw, Poland; St. Ghislain, Belgium) |
3.2 AI Model Providers (used only when an AI Feature that uses them is enabled)
These providers process the prompts, context and content sent to an AI Feature (for example, the Backoffice assistant), which may include customer data that a user includes. Organisations can choose or restrict providers, and may connect their own provider accounts, in which case that provider acts under the organisation’s own terms.
| Subprocessor | Purpose | Location |
|---|---|---|
| Anthropic, PBC | Large language model inference | United States |
| OpenAI, L.L.C. | Large language model inference and text-to-speech | United States |
| Google LLC (Gemini API) | Large language model inference | United States |
| Other model providers available through our AI gateway (xAI, Groq, Cerebras, Mistral AI, OpenRouter, Vercel AI Gateway, Hugging Face, OneProvider) | Large language model inference, only if enabled for an organisation | United States and/or European Union, depending on provider |
3.3 Payment Service Providers (used only when payment features are enabled)
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe, Inc. and affiliates | Card payments, wallet top-ups, invoicing | Billing contact and payment data | United States / global |
| Plisio | Cryptocurrency payments | Billing contact and payment data | Global |
| Mercury Technologies, Inc. | Bank transfers | Billing contact and payment data | United States |
3.4 Communications
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Google LLC (Google Workspace) | Business email for correspondence sent to us | Contents of emails you send us | Global |
| Resend, Inc. | Newsletter audience management (only when enabled) | Newsletter subscriber email and preferences | United States |
| Amazon Web Services, Inc. (Amazon Simple Email Service) | Backup transactional email delivery, used only if Cloudflare’s email service is unavailable and only once we have enabled it as a failover provider | Recipient email address and email content | United States and/or European Union, depending on the AWS region we select |
3.5 Content Loaded in the Backoffice
The Backoffice map views load map tiles from Esri (ArcGIS imagery) and OpenFreeMap. These providers receive the viewing user’s IP address and the map area requested; they do not receive customer data.
4. Security of Subprocessors
We select Subprocessors that we reasonably believe maintain appropriate security measures, and we require them by contract to protect personal data in a manner consistent with applicable data protection law. Many of them publish independent certifications (for example, SOC 2 or ISO 27001). Information about their certifications is available from the Subprocessors directly. We do not warrant the performance or security of any Subprocessor except to the extent required by applicable data protection law and the DPA.
5. International Transfers
Subprocessors may process data outside your country, including in the United States and other countries that may not provide an equivalent level of data protection. Where required, transfers are made under the European Commission’s Standard Contractual Clauses (and the UK and Swiss equivalents) contained in our DPA and in the Subprocessors’ own data processing terms, or another mechanism permitted by law. See Section 7 of our Privacy Policy.
6. Changes to This List
6.1 Notification
We may add or replace Subprocessors at any time. We will update this page before a new Subprocessor begins processing customer personal data, and update the “Last Updated” date and version. Customers who want to be notified by email can request this at [email protected] with the subject “Subprocessor Notifications”; we will then notify them of new Subprocessors at least fifteen (15) days in advance, except where a change is urgently needed for security or continuity of the Services.
6.2 Objections
A customer may object to a new Subprocessor on reasonable data protection grounds by emailing [email protected] within the notice period. We will consider the objection in good faith. If we do not change the Subprocessor, the customer’s sole and exclusive remedy is to stop using, and terminate, the affected Service before the change takes effect, without refund except as required by law.
7. Historical Changes
| Date | Change |
|---|---|
| October 7, 2026 | Amazon Web Services, Inc. (Amazon Simple Email Service) added as the backup (failover) transactional email provider |
| October 4, 2026 | List expanded to reflect current infrastructure, AI providers, payment providers and communications providers; Noxtica-operated infrastructure disclosed |
| January 11, 2026 | Initial publication |
8. Language; Controlling Version
Only the English version of this page is legally valid and binding. The controlling version is the English text published at https://noxtica.com/subprocessors. Any translation of this page is provided for reference purposes only, does not have any legal value and should not be relied upon as a legally binding document. In the event of any discrepancies or inconsistencies between a translation and the English version, the English version shall prevail.
9. Contact
For questions about our Subprocessors: [email protected] (subject: “Subprocessor Inquiry”).
This Subprocessor list is effective as of the Effective Date above.