Sub-Processors
Last updated: May 14, 2026
Introduction
This page lists the third-party service providers (“sub-processors”) that Nyvion LLC (“GMC Medic,” “we,” “us,” or “our”) engages to help us provide the GMC Medic service. Each sub-processor is contractually bound to handle your data in accordance with our Privacy Policy and (where applicable) our Data Processing Agreement.
We notify customers at least 30 days in advance of adding a new sub-processor or making material changes to this list. Notice is provided by email to the account email on file and by updating this page.
If you have questions or wish to object to a sub-processor, email us at support@getgmcmedic.com.
Current Sub-Processors
The following sub-processors process Personal Data on behalf of GMC Medic customers:
Infrastructure and Hosting
| Sub-Processor | Purpose | Data Processed | Location | Privacy Policy |
|---|---|---|---|---|
| Vercel, Inc. | Application hosting, serverless compute, edge networking, DDoS protection | Server logs, request metadata, IP addresses | United States | vercel.com/legal/privacy-policy |
| Supabase, Inc. | Database hosting, user authentication, row-level security | All stored Personal Data, account credentials, scan results | United States | supabase.com/privacy |
| Inngest, Inc. | Background job orchestration for compliance scans | Scan job metadata, internal IDs | United States | inngest.com/privacy |
AI and Analysis
| Sub-Processor | Purpose | Data Processed | Location | Privacy Policy |
|---|---|---|---|---|
| Anthropic, PBC | AI analysis of store content for compliance findings (Claude Sonnet, Claude Haiku) | Product titles and descriptions, scraped policy page excerpts, business profile fields, About page text. Processed on a no-training basis under our commercial agreement. | United States | anthropic.com/legal/privacy |
Crawling and Data Sources
| Sub-Processor | Purpose | Data Processed | Location | Privacy Policy |
|---|---|---|---|---|
| Firecrawl | Crawling publicly accessible pages of merchant storefronts | Storefront URLs, scraped page content | United States | firecrawl.dev/privacy |
| Google LLC | Google Merchant Center API — source of compliance status data merchant has authorized us to read | GMC account status, account issues, product feed status, product issues | United States | policies.google.com/privacy |
| Shopify Inc. | Shopify Admin API — source of product data merchant has authorized us to read | Shopify product catalog, shop metadata | Canada / United States | shopify.com/legal/privacy |
Payments
| Sub-Processor | Purpose | Data Processed | Location | Privacy Policy |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription management, tax calculation | Billing email, payment card details (held by Stripe, not by us), invoice records | United States | stripe.com/privacy |
Communications
| Sub-Processor | Purpose | Data Processed | Location | Privacy Policy |
|---|---|---|---|---|
| Resend | Transactional email delivery (scan notifications, account alerts, billing receipts) | Account email address, email content | United States | resend.com/legal/privacy-policy |
How We Choose Sub-Processors
Before engaging any sub-processor, we evaluate:
- •Security posture — independent audits (SOC 2, ISO 27001, etc.) where applicable.
- •Data protection commitments — published privacy policy, DPA, and SCC availability.
- •Necessity — whether the function genuinely requires a third-party service, or whether it can be performed in-house.
We prefer sub-processors that publish their own sub-processor lists and provide transparent data residency and security documentation.
International Data Transfers
Most of our sub-processors are located in the United States. Where Personal Data of European Economic Area, United Kingdom, or Swiss Data Subjects is transferred to the United States, we rely on Standard Contractual Clauses (“SCCs”) approved by the European Commission, the UK International Data Transfer Addendum, and the equivalent Swiss instruments, as applicable. Some sub-processors are additionally certified under the EU-US Data Privacy Framework.
For more detail on international transfers, see Section 7 of our Privacy Policy and Section 8 of our Data Processing Agreement.
Notification of Changes
We notify customers of changes to this list:
- •New sub-processor: Email and update to this page at least 30 days before the new sub-processor begins processing Personal Data.
- •Removal of a sub-processor: Update to this page; email if the removal materially changes how a customer's data is processed.
- •Change of purpose for an existing sub-processor: Email and update to this page at least 30 days in advance.
To subscribe to sub-processor updates, email support@getgmcmedic.com with “Subprocessor Updates” in the subject. You will also receive these notices automatically as a paying customer.
Objecting to a Sub-Processor
If you object to a new sub-processor on reasonable grounds related to data protection, email support@getgmcmedic.com within 30 days of the notice. We will work with you in good faith to address your concerns. If we cannot resolve the objection, you may terminate your subscription with respect to the services affected by the new sub-processor.
Contact
Email: support@getgmcmedic.com
Mailing address: Nyvion LLC, 2150 Renault Dr, Saint Louis, MO 63146
© 2026 Nyvion LLC. Not affiliated with Google LLC.