Subprocessors & data transfers
Current list of processors and data recipients, with categories, location, and legal safeguards — as of 8 October 2026.
1. Introduction
LegaFund AG (controller) uses a carefully selected set of processors ("subprocessors") to deliver the neurapay.ai website and our services. This page complements section 5 of our privacy policy by documenting each provider, the data categories involved, the hosting location and the legal safeguards for any transfer outside Switzerland / the EU.
2. Confirmed subprocessors (in production)
| Provider | Purpose | Data categories | Location | Legal basis / safeguard |
|---|---|---|---|---|
| Cloudflare Inc. — Turnstile | Bot protection for website chat and sales/demo-code requests | IP address, browser and connection signals; no chat content or form fields sent by us | Global network; not restricted to Switzerland/EU | Cloudflare Data Processing Addendum and Turnstile Privacy Addendum |
| Microsoft — Azure Storage / Microsoft 365 Bookings | Sales inquiries, demo scheduling and calendar invitations | Contact details, plan selections, booking data; pseudonymized abuse-prevention counters | Azure Storage: CH — Switzerland North; Bookings: according to Microsoft 365 tenant configuration | Microsoft Products and Services Data Protection Addendum |
| Google Cloud Platform (Google Ireland Ltd.) | Hosting & infrastructure (databases, object storage) | All customer data, logs | CH — Zurich (europe-west6) | DPA, SCC 2021/914 Module 2, Swiss Addendum |
| Vercel Inc. | Hosting of neurapay.ai (edge / serverless functions), Nura chat logs | Request and response metadata; no complete chat transcripts in application logs | fra1 (Frankfurt, EU) | DPA, SCC, EU-US DPF (US parent) |
| Stripe Payments Europe Ltd. | Payments processing (B2B invoices, cards; TWINT* via Stripe is planned from Q4 2026) | Payer, amount, tokenised card data | IE / EU | DPA, SCC, EU-US DPF (US parent) |
| Mixpanel Inc. (EU Data Residency) | Product analytics, A/B tests | Pseudonymous event data, device hash | EU residency enabled | DPA, SCC, EU-US DPF (US parent) |
| Microsoft — Azure OpenAI | AI responses inside the Nura chat | Message content, language, page context (no IP) | EU Data Zone (DataZoneStandard; Azure resource in Sweden) | Microsoft Products and Services Data Protection Addendum; abuse monitoring under Azure terms. |
| Mailgun Technologies Inc. (api.eu.mailgun.net) | Transactional email delivery (contact, applications) | Email address, message content, metadata | EU endpoint (Frankfurt) | DPA, SCC, EU-US DPF (US parent) |
3. Conditional subprocessors (only when enabled)
The following providers are only loaded when the corresponding configuration (environment variable) is set. Loading the site without activation does not establish any connection to them.
| Provider | Trigger | Purpose | Location | Legal basis |
|---|---|---|---|---|
| HubSpot Ireland Ltd. | PUBLIC_HUBSPOT_MEETING_URL set | Meeting booking inside the Nura chat | IE / EU | DPA, SCC, EU-US DPF (US parent) |
| Crisp IM SAS | PUBLIC_CRISP_WEBSITE_ID set + handoff triggered | Live-chat handoff (human) | FR / EU | DPA, revFADP / GDPR compliant (EU vendor) |
4. Services we do NOT use (negative list)
In the interest of full transparency, we expressly confirm that a number of widely used tracking and advertising technologies are deliberately not deployed on neurapay.ai. This includes in particular Google Analytics, Google Ads and comparable reach-measurement services, the Meta/Facebook Pixel and the Facebook Conversion API, the LinkedIn Insight Tag, the TikTok Pixel, as well as session-replay tools such as Hotjar or FullStory. We also refrain from integrating marketing-oriented chat widgets (such as Intercom or Zendesk Chat) and from hooking into retargeting networks or demand-side platforms (DSPs).
5. Changes and notifications
The set of subprocessors may change as the platform evolves. Material changes (new provider, data region outside CH/EU) are announced on this page at least 30 days in advance, unless compelling security or operational reasons require a shorter window.
B2B customers with an individual Data Processing Agreement (DPA) additionally receive written notice of changes per the procedure agreed in the DPA.
6. Contact
Questions about subprocessors, data transfers or DPAs: datenschutz@lega-fund.com.
