Last updated: May 29, 2026
This page lists the third-party subprocessors that Conaxity Inc. engages to process personal data on behalf of our customers. This list is maintained as part of our GDPR and data protection compliance obligations. For details on how we collect and use personal data, please see our Privacy Policy.
| Subprocessor | Entity | Location | Purpose | Data Processed | Applicability |
|---|---|---|---|---|---|
| Google Cloud Platform | Google LLC | USA (us-central1) and EU (europe-west1) — per customer region | Cloud compute (Cloud Functions / Cloud Run) for all API and backend processing | All request data including user IDs, emails, IP addresses, request headers | CORE |
| Google Cloud SQL | Google LLC | USA (us-central1) and EU (europe-west1) — per customer region | Primary PostgreSQL application database | Names, emails, phone numbers, user identities, roles, audit logs, booking data, form submissions, chat messages | CORE |
| Google Cloud Logging | Google LLC | USA | Application logging and error monitoring | User IDs, emails, IP addresses, device info, error details, request metadata | CORE |
| Firebase Hosting | Google LLC | USA (global CDN) | Serves the web application (CMP) and marketing website via global CDN | IP addresses, request headers, browser User-Agent | CORE |
| Google Fonts | Google LLC | USA (global CDN) | Web font delivery for application and policy pages | IP addresses, HTTP referrer headers | CORE |
| Subprocessor | Entity | Location | Purpose | Data Processed | Applicability |
|---|---|---|---|---|---|
| Firebase Authentication | Google LLC | USA | User authentication (Google, Microsoft, Phone, Email/Password sign-in) | Email, display name, profile picture URL, phone number, OAuth UIDs, provider identities | CORE |
| Google Sign-In | Google LLC | USA | OAuth authentication provider | Google account email, name, profile picture, OAuth tokens | OPTIONAL When user chooses Google sign-in |
| Microsoft Entra ID | Microsoft Corporation | USA / Global | OAuth authentication provider (Microsoft sign-in) | Microsoft account email, name, profile picture, OAuth tokens | OPTIONAL When user chooses Microsoft sign-in |
| Apple Sign-In | Apple Inc. | USA / Global | OAuth authentication provider (Sign in with Apple) | Apple account email (or relay address), name, OAuth tokens | OPTIONAL When user chooses Apple sign-in |
| Firebase App Check | Google LLC | USA | Device attestation to prevent API abuse (Play Integrity / DeviceCheck / reCAPTCHA) | Device attestation tokens, device fingerprint data | CORE |
| Subprocessor | Entity | Location | Purpose | Data Processed | Applicability |
|---|---|---|---|---|---|
| Microsoft Graph (Office 365) | Microsoft Corporation | USA / Global | Transactional email delivery (notifications, sign-in links, booking alerts) | Recipient email addresses, email content (booking details, notification text, user names) | CORE |
| Firebase Cloud Messaging | Google LLC | USA | Push notifications to mobile and web clients | FCM device tokens, notification payloads (sender name, message preview), device platform | CORE |
| Apple Push Notification service | Apple Inc. | USA | iOS push notification delivery (via FCM) | APNs device tokens, notification payloads | OPTIONAL iOS mobile app users only |
| Subprocessor | Entity | Location | Purpose | Data Processed | Applicability |
|---|---|---|---|---|---|
| Firebase Storage | Google LLC | USA (us-central1) and EU (europe-west1) — per customer region | File storage for user profile pictures, asset images, certificate attachments | Uploaded images (may contain identifiable content), certificate files | CORE |
| Firebase Firestore | Google LLC | USA (nam5) and EU (eur3) — per customer region | Real-time data invalidation signals between backend and clients | Organization IDs, revision counters, actor user IDs (metadata only) | CORE |
| Subprocessor | Entity | Location | Purpose | Data Processed | Applicability |
|---|---|---|---|---|---|
| Trackunit | Trackunit A/S | Denmark (EU) | Equipment telematics, digital key access, badge/PIN access management. The customer holds the Trackunit account and provides credentials; Conaxity calls the Trackunit API on the customer's behalf. | User display name, user email, operator IDs, access key data, asset GPS coordinates | OPTIONAL When Trackunit integration is enabled |
| TTLock | Sciener Smart Technology Co., Ltd. (Hangzhou) | EU server | Digital lock and key access. The customer holds the TTLock account and provides credentials; Conaxity calls the TTLock API on the customer's behalf. | Lock and key operation requests, customer-provided lock identifiers | OPTIONAL When TTLock integration is enabled |
| Subprocessor | Entity | Location | Purpose | Data Processed | Applicability |
|---|---|---|---|---|---|
| OpenAI | OpenAI, L.L.C. | USA | AI-powered translation (UI, chat messages), equipment wear analysis (vision). Processed under OpenAI's standard Data Processing Addendum. | Text submitted for translation (may contain user-generated content), equipment inspection photos | OPTIONAL When AI features are enabled and OpenAI is selected |
| Anthropic | Anthropic PBC | USA | Alternative AI provider for translation and wear analysis. Processed under Anthropic's standard Data Processing Addendum. | Same as OpenAI — text for translation, inspection photos | OPTIONAL When AI features are enabled and Anthropic is selected |
| Subprocessor | Entity | Location | Purpose | Data Processed | Applicability |
|---|---|---|---|---|---|
| Intuit QuickBooks Online | Intuit Inc. | USA | Invoice syncing for Conaxity’s own billing operations (OAuth 2.0 integration). Not customer-facing. | Customer/organization names, billing addresses, invoice line items, payment amounts, tax codes | CORE Internal billing only |
| Subprocessor | Entity | Location | Purpose | Data Processed | Applicability |
|---|---|---|---|---|---|
| HubSpot | HubSpot, Inc. | USA | Marketing website analytics, cookie tracking, contact form capture | IP addresses, browsing behavior (page views, session duration, clicks), form submissions (name, email) | MARKETING Marketing website only; not used in the application |
| Subprocessor | Entity | Location | Purpose | Data Processed | Applicability |
|---|---|---|---|---|---|
| Google Maps Platform | Google LLC | USA | Map display for asset locations, geocoding (address-to-coordinates lookup), and geolocation features | User GPS coordinates, addresses submitted for geocoding, map interaction data, IP address | CORE |
We may update this subprocessor list from time to time. When we engage a new subprocessor that processes personal data, we will update this page. If you have subscribed to subprocessor change notifications as part of your service agreement, we will notify you of material changes in advance.
If you have questions about our subprocessors or data processing practices, please contact our Privacy Officer at info@conaxity.com.