Nexus
Data Processors
Sub-processors that handle personal data on the Foundation's behalf in the course of operating the Services.
What this list is
A "sub-processor" is a third-party service provider that handles personal data on the Foundation's behalf in the course of operating the Services. This list identifies the Foundation's current sub-processors, the service each provides, the categories of personal data each handles, and the primary jurisdiction of processing. It is published as a transparency disclosure.
This list is not a substitute for, and the Foundation does not represent it as evidencing, formal data-processing contracts (such as Article 28 GDPR or analogous instruments) with each listed sub-processor. The Foundation is developing a fuller sub-processor governance program post-mainnet; this list is the basis from which that program builds.
This list includes only sub-processors that handle user personal data on the Foundation's behalf. Service providers used solely for internal operations (for example, billing and certain contractor engagements) are out of scope of this disclosure.
Note on third-party cookie providers. Third-party platforms whose cookies or tracking pixels are set on the Site (for example, Meta) operate as separate data controllers with their own privacy practices in that context, rather than as sub-processors of the Foundation. Those third parties are described in the Cookie Policy. Where the same platform also handles personal data on the Foundation's behalf in a different context — for example, X as a community-channel host — it is listed below as a sub-processor for that role.
Current sub-processors
Cloudflare
Service: DNS, content delivery network, edge worker (including OFAC geo-block on app.nexus.xyz)
Data handled: IP address, request metadata, geo-region
Primary location: United States (global edge)
Privacy policy: https://www.cloudflare.com/privacypolicy/
Ghost (Ghost(Pro))
Service: Hosting platform for blog.nexus.xyz
Data handled: IP address, page-view metadata, browser metadata
Primary location: Republic of Ireland
Privacy policy: https://ghost.org/privacy/
Google Cloud Platform (GCP)
Service: Backend infrastructure (envoy gateway, RPC nodes, supporting services)
Data handled: IP address, request metadata, RPC request logs
Primary location: Multi-region
Privacy policy: https://cloud.google.com/privacy
Firebase (Google)
Service: Backend services on selected Foundation surfaces (e.g., prove.nexus.xyz)
Data handled: Email address, account identifiers, usage metadata
Primary location: United States
Privacy policy: https://firebase.google.com/support/privacy
MaxMind
Service: GeoIP database used for geo-restriction at the network edge
Data handled: IP address (resolved to country / region)
Primary location: United States
Privacy policy: https://www.maxmind.com/en/privacy-policy
Snag
Service: Platform partner hosting Foundation loyalty / quest Programs and supporting Foundation engagement workflows
Data handled: Wallet address, email address (where collected), program-participation metadata
Primary location: United States
Privacy policy: https://snagsolutions.io/privacy-policy
Mailchimp (Intuit)
Service: Email-marketing platform for opted-in user communications
Data handled: Email address, communication-preference metadata
Primary location: United States
Privacy policy: https://www.intuit.com/privacy/statement/
SendGrid (Twilio)
Service: Email delivery (transactional and marketing)
Data handled: Email address, delivery metadata
Primary location: United States
Privacy policy: https://www.twilio.com/legal/privacy
Google Analytics
Service: Web analytics on the Site (including Google Tag Manager for tag management)
Data handled: IP address (truncated where supported), browser metadata, page-view metadata
Primary location: United States
Privacy policy: https://policies.google.com/privacy
Sentry
Service: Application error tracking and session replay
Data handled: IP address, browser metadata, error stack traces, session replay traces
Primary location: United States
Privacy policy: https://sentry.io/privacy/
Axiom
Service: Log analytics (application and request logs)
Data handled: IP address, request metadata, application logs
Primary location: United States
Privacy policy: https://axiom.co/privacy
Dynamic Labs
Service: Wallet-based authentication and signup workflows on selected Foundation surfaces
Data handled: Email address, wallet address, signup metadata
Primary location: United States
Privacy policy: https://www.dynamic.xyz/legal/privacy-policy
Discord
Service: Community channel hosting — Foundation-operated server
Data handled: Member identifiers, public messages, direct messages to Foundation accounts
Primary location: United States
Privacy policy: https://discord.com/privacy
Telegram
Service: Community channel hosting — Foundation-operated group
Data handled: Member identifiers, public messages, direct messages to Foundation accounts
Primary location: United Arab Emirates
Privacy policy: https://telegram.org/privacy
X (community account)
Service: Community channel hosting — Foundation-operated X account (distinct from X advertising pixel described in the Cookie Policy)
Data handled: Follower identifiers, public messages, direct messages to Foundation accounts
Primary location: United States
Privacy policy: https://x.com/en/privacy
The list above describes sub-processors known to the Foundation as of the Effective Date. The Foundation is conducting a more complete sub-processor inventory as part of its post-mainnet program, and will update this list as additional sub-processors are identified or as existing relationships are added, removed, or materially changed.
Updates and notification
The Foundation maintains this list and updates it when it adds, removes, or materially changes a sub-processor relationship that handles user personal data. Updates are reflected in this published list (with an updated "Last Updated" date in the header) and, where applicable, in the changelog at the bottom. Material changes are reflected in the Privacy Policy changelog as well, where applicable.
Contact
For questions about this Sub-processor List or about how the Foundation works with sub-processors, you may contact the Foundation at:
Nexus Foundation
c/o Walkers Corporate Limited
190 Elgin Avenue
George Town, Grand Cayman KY1-9008
Cayman Islands
Email: privacy@nexusfnd.org