Last updated: March 2026

Sub-processors

Neshys uses the following third-party service providers (sub-processors) to operate the platform. Each sub-processor processes personal data only as necessary to provide their specific service. We maintain data processing agreements with all sub-processors listed below.

We will update this page when we add or replace a sub-processor. Material changes will be communicated to users via email or in-app notification in advance.

Provider	Purpose	Data processed	Location
Mailgun (Sinch Email)	Campaign email delivery	Sender email address, recipient email addresses, email subject and body content, attachment URLs, delivery event data (bounces, opens, clicks, complaints)	European Union
Resend (Plus Five Five, Inc.)	Transactional email delivery	User email address, email verification and password reset email content (generated from templates)	United States (email dispatch via EU — Ireland)
Hetzner Online GmbH	Server hosting and compute infrastructure	All application data in transit and in memory during processing (API requests, background tasks, cached sessions)	European Union (Germany/Finland)
Ubicloud	Managed PostgreSQL database	All persistent application data: user accounts, workspace data, contacts, campaigns, email events, tags, rules, suppression lists	European Union
Amazon Web Services (AWS)	File storage (S3)	Campaign attachment files, email signature images	European Union
Google LLC	Social login (Google Identity Services)	Google account identifier, email address, and name — only when user chooses Google sign-in. No contact or campaign data is shared.	United States

Data processed by each provider

Mailgun (Sinch Email)

Sender email address, recipient email addresses, email subject and body content, attachment URLs, delivery event data (bounces, opens, clicks, complaints)

Resend (Plus Five Five, Inc.)

User email address, email verification and password reset email content (generated from templates)

Hetzner Online GmbH

All application data in transit and in memory during processing (API requests, background tasks, cached sessions)

Ubicloud

All persistent application data: user accounts, workspace data, contacts, campaigns, email events, tags, rules, suppression lists

Amazon Web Services (AWS)

Campaign attachment files, email signature images

Google LLC

Google account identifier, email address, and name — only when user chooses Google sign-in. No contact or campaign data is shared.

International transfer safeguards

For sub-processors located outside the European Economic Area (EEA), we rely on the following legal mechanisms to ensure adequate data protection:

EU-US Data Privacy Framework (DPF): Resend is certified under the DPF.
Standard Contractual Clauses (SCCs): We maintain SCCs with Google as part of our data processing agreement.
EU-based providers: Mailgun (EU region), Hetzner, Ubicloud, and AWS (EU region) process data within the EEA, requiring no additional transfer mechanisms.

If you have questions about our sub-processors or data processing practices, please contact us at [email protected].

See our Privacy Policy for full details on how we collect, use, and protect your data.