Data Processors

What this list is

A "sub-processor" is a third-party service provider that handles personal data on the Foundation's behalf in the course of operating the Services. This list identifies the Foundation's current sub-processors, the service each provides, the categories of personal data each handles, and the primary jurisdiction of processing. It is published as a transparency disclosure.

This list is not a substitute for, and the Foundation does not represent it as evidencing, formal data-processing contracts (such as Article 28 GDPR or analogous instruments) with each listed sub-processor. The Foundation is developing a fuller sub-processor governance program post-mainnet; this list is the basis from which that program builds.

This list includes only sub-processors that handle user personal data on the Foundation's behalf. Service providers used solely for internal operations (for example, billing and certain contractor engagements) are out of scope of this disclosure.

*Note on third-party cookie providers.* Third-party platforms whose cookies or tracking pixels are set on the Site (for example, Meta) operate as separate data controllers with their own privacy practices in that context, rather than as sub-processors of the Foundation. Those third parties are described in the [Cookie Policy](https://nexus.xyz/cookie-policy). Where the same platform also handles personal data on the Foundation's behalf in a different context — for example, X as a community-channel host — it is listed below as a sub-processor for that role.

Current sub-processors

Vendor: Cloudflare
Service: DNS, content delivery network, edge worker
(including OFAC geo-block on app.nexus.xyz)
Data handled: IP address, request metadata, geo-region
Primary location: United States (global edge)
Privacy policy: https://www.cloudflare.com/privacypolicy/

Vendor: Ghost (Ghost(Pro))
Service: Hosting platform for blog.nexus.xyz
Data handled: IP address, page-view metadata, browser metadata
Primary location: Republic of Ireland
Privacy policy: https://ghost.org/privacy/

Vendor: Google Cloud Platform (GCP)
Service: Backend infrastructure (envoy gateway, RPC nodes,
supporting services)
Data handled: IP address, request metadata, RPC request logs
Primary location: Multi-region
Privacy policy: https://cloud.google.com/privacy

Vendor: Firebase (Google)
Service: Backend services on selected Foundation surfaces
(e.g., prove.nexus.xyz)
Data handled: Email address, account identifiers, usage
metadata
Primary location: United States
Privacy policy: https://firebase.google.com/support/privacy

Vendor: MaxMind
Service: GeoIP database used for geo-restriction at the
network edge
Data handled: IP address (resolved to country / region)
Primary location: United States
Privacy policy: https://www.maxmind.com/en/privacy-policy

Vendor: Snag
Service: Platform partner hosting Foundation loyalty /
quest Programs and supporting Foundation
engagement workflows
Data handled: Wallet address, email address (where collected),
program-participation metadata
Primary location: United States
Privacy policy: https://snagsolutions.io/privacy-policy

Vendor: Mailchimp (Intuit)
Service: Email-marketing platform for opted-in user
communications
Data handled: Email address, communication-preference metadata
Primary location: United States
Privacy policy: https://www.intuit.com/privacy/statement/

Vendor: SendGrid (Twilio)
Service: Email delivery (transactional and marketing)
Data handled: Email address, delivery metadata
Primary location: United States
Privacy policy: https://www.twilio.com/legal/privacy

Vendor: Google Analytics
Service: Web analytics on the Site (including Google Tag
Manager for tag management)
Data handled: IP address (truncated where supported), browser
metadata, page-view metadata
Primary location: United States
Privacy policy: https://policies.google.com/privacy

Vendor: Sentry
Service: Application error tracking and session replay
Data handled: IP address, browser metadata, error stack traces,
session replay traces
Primary location: United States
Privacy policy: https://sentry.io/privacy/

Vendor: Axiom
Service: Log analytics (application and request logs)
Data handled: IP address, request metadata, application logs
Primary location: United States
Privacy policy: https://axiom.co/privacy

Vendor: Dynamic Labs
Service: Wallet-based authentication and signup workflows
on selected Foundation surfaces
Data handled: Email address, wallet address, signup metadata
Primary location: United States
Privacy policy: https://www.dynamic.xyz/legal/privacy-policy

Vendor: Discord
Service: Community channel hosting — Foundation-operated
server
Data handled: Member identifiers, public messages, direct
messages to Foundation accounts
Primary location: United States
Privacy policy: https://discord.com/privacy

Vendor: Telegram
Service: Community channel hosting — Foundation-operated
group
Data handled: Member identifiers, public messages, direct
messages to Foundation accounts
Primary location: United Arab Emirates
Privacy policy: https://telegram.org/privacy

Vendor: X (community account)
Service: Community channel hosting — Foundation-operated
X account (distinct from X advertising pixel
described in the Cookie Policy)
Data handled: Follower identifiers, public messages, direct
messages to Foundation accounts
Primary location: United States
Privacy policy: https://x.com/en/privacy

The list above describes sub-processors known to the Foundation as of the Effective Date. The Foundation is conducting a more complete sub-processor inventory as part of its post-mainnet program, and will update this list as additional sub-processors are identified or as existing relationships are added, removed, or materially changed.

Updates and notification

The Foundation maintains this list and updates it when it adds, removes, or materially changes a sub-processor relationship that handles user personal data. Updates are reflected in this published list (with an updated "Last Updated" date in the header) and, where applicable, in the changelog at the bottom. Material changes are reflected in the [Privacy Policy](https://nexus.xyz/privacy-policy) changelog as well, where applicable.

Contact

For questions about this Sub-processor List or about how the Foundation works with sub-processors, you may contact the Foundation at:

Nexus Foundation

c/o Walkers Corporate Limited

190 Elgin Avenue

George Town, Grand Cayman KY1-9008

Cayman Islands

Email: `privacy@nexusfnd.org`