Subprocessors & data transfers
Current list of processors and data recipients, with categories, location, and legal safeguards — as of 18 April 2026.
1. Introduction
LegaFund AG (controller) uses a carefully selected set of processors ("subprocessors") to deliver the neurapay.ai website and our services. This page complements section 5 of our privacy policy by documenting each provider, the data categories involved, the hosting location and the legal safeguards for any transfer outside Switzerland / the EU.
2. Confirmed subprocessors (in production)
| Provider | Purpose | Data categories | Location | Legal basis / safeguard |
|---|---|---|---|---|
| Google Cloud Platform (Google Ireland Ltd.) | Hosting & infrastructure (databases, object storage) | All customer data, logs | EU / CH | DPA, SCC 2021/914 Module 2, Swiss Addendum |
| Vercel Inc. | Hosting of neurapay.ai (edge / serverless functions), Nura chat logs | Request metadata, Nura conversations (30 days) | fra1 (Frankfurt, EU) | DPA, SCC, EU-US DPF (US parent) |
| Stripe Payments Europe Ltd. | Payments processing (B2B invoices, cards) | Payer, amount, tokenised card data | IE / EU | DPA, SCC, EU-US DPF (US parent) |
| TWINT AG | Swiss debtor payment processing | Payer, amount, case reference | CH | DPA, Swiss revFADP |
| Mixpanel Inc. (EU Data Residency) | Product analytics, A/B tests | Pseudonymous event data, device hash | EU residency enabled | DPA, SCC, EU-US DPF (US parent) |
| Google Ireland Ltd. — Gemini API | AI responses inside the Nura chat | Message content, language, page context (no IP) | EU region (generativelanguage) | Google Cloud DPA, SCC, EU-US DPF (US parent). No training use per API terms. |
| Mailgun Technologies Inc. (api.eu.mailgun.net) | Transactional email delivery (contact, applications) | Email address, message content, metadata | EU endpoint (Frankfurt) | DPA, SCC, EU-US DPF (US parent) |
3. Conditional subprocessors (only when enabled)
The following providers are only loaded when the corresponding configuration (environment variable) is set. Loading the site without activation does not establish any connection to them.
| Provider | Trigger | Purpose | Location | Legal basis |
|---|---|---|---|---|
| HubSpot Ireland Ltd. | PUBLIC_HUBSPOT_MEETING_URL set | Meeting booking inside the Nura chat | IE / EU | DPA, SCC, EU-US DPF (US parent) |
| Crisp IM SAS | PUBLIC_CRISP_WEBSITE_ID set + handoff triggered | Live-chat handoff (human) | FR / EU | DPA, revFADP / GDPR compliant (EU vendor) |
4. Services we do NOT use (negative list)
In the interest of full transparency, we expressly confirm that a number of widely used tracking and advertising technologies are deliberately not deployed on neurapay.ai. This includes in particular Google Analytics, Google Ads and comparable reach-measurement services, the Meta/Facebook Pixel and the Facebook Conversion API, the LinkedIn Insight Tag, the TikTok Pixel, as well as session-replay tools such as Hotjar or FullStory. We also refrain from integrating marketing-oriented chat widgets (such as Intercom or Zendesk Chat) and from hooking into retargeting networks or demand-side platforms (DSPs).
5. Changes and notifications
The set of subprocessors may change as the platform evolves. Material changes (new provider, data region outside CH/EU) are announced on this page at least 30 days in advance, unless compelling security or operational reasons require a shorter window.
B2B customers with an individual Data Processing Agreement (DPA) additionally receive written notice of changes per the procedure agreed in the DPA.
6. Contact
Questions about subprocessors, data transfers or DPAs: datenschutz@lega-fund.com.
