Subprocessor and Service Provider List

1. Scope and update date

This list identifies CVNexus service providers as of August 19, 2026. A provider is listed as a subprocessor when it may process personal data on behalf of CVNexus to deliver the Service.

CVNexus will update this list when a material provider or processing purpose changes and will provide any advance notice required by applicable law, an Order Form, or the Data Processing Addendum. Questions or objections may be sent to dee@famoussent.com.

2. Direct production service providers

Wix.com Ltd. / Base44 branded services Relationship: Core platform processor. Purpose: Application hosting, database and entity storage, authentication, serverless functions, file and media services, transactional email, security logging, operational analytics, managed AI invocation, and platform support. Data: Account identity, authentication data, organization and project records, Customer Content, files, usage and security logs, support information, technical metadata, and permission-filtered prompts/context/output when a user invokes a released Base44-managed AI capability. Processing location: United States by default for app data; Base44 operator and downstream processing locations are described in the Base44 DPA and published subprocessor exhibit. Status: Active platform dependency

Stripe, Inc. Relationship: Payment and billing processor. Purpose: Hosted Checkout, subscription billing, invoices, payment-method processing, fraud prevention, hosted Billing Portal, cancellation, and payment-status webhooks. Data: Billing contact, business name, email, billing address, plan and seat selections, Stripe customer and subscription identifiers, invoices, payment status, transaction metadata, and payment information entered directly into Stripe-hosted interfaces. Processing location: United States and other locations used by Stripe under its privacy and data-transfer framework. Status: Used when a customer enables subscription billing or manages an active subscription.

3. Conditional identity provider

Google LLC Relationship: Optional identity provider and customer-directed Google Workspace reporting and CRM metadata integration. Purpose: Google sign-in and, after separate organization authorization, controlled spreadsheet reporting plus CRM synchronization of Gmail metadata and Calendar event metadata involving existing CRM contacts. Data: Google account identifier, name, email, authorization metadata, granted scopes, selected spreadsheet identifier, controlled reporting rows, and matched email/calendar metadata such as participants, subject, dates, event timing, and provider identifiers. The released CRM workflow does not request email message bodies. Processing location: Processed under Google’s global infrastructure, customer agreement, and privacy terms. Status: Conditional; Google processing occurs only when an individual signs in with Google or the company owner authorizes the available Google Workspace reporting and CRM metadata connection.

Microsoft Corporation Relationship: Optional identity provider and customer-directed Microsoft 365 reporting and CRM metadata integration. Purpose: Microsoft sign-in and, after separate organization authorization, controlled Excel reporting plus CRM synchronization of basic mail and calendar metadata involving existing CRM contacts. Data: Microsoft account identifier, name, email, tenant and authorization metadata, granted scopes, selected workbook identifier and table name, controlled reporting rows, and matched email/calendar metadata such as participants, subject, dates, event timing, and provider identifiers. The released CRM workflow does not request email message bodies or attachments. Processing location: Processed under Microsoft’s global infrastructure, customer agreement, and privacy terms. Status: Conditional; Microsoft processing occurs only when an individual signs in with Microsoft or the company owner authorizes the available Microsoft 365 reporting and CRM metadata connection.

Adobe Inc. Relationship: Optional customer-directed electronic-signature integration. Purpose: Customer-directed Adobe Acrobat Sign authorization, sending eligible approved or issued commercial documents from governed PDFs, and agreement-status monitoring. Data: Adobe account authorization metadata, granted scopes, encrypted OAuth credentials, Customer-selected signer email addresses, the governed PDF selected for transmission, Adobe agreement identifiers, signature workflow status, request/completion timestamps, and audit references. Processing location: Processed under Adobe’s service, regional-hosting, data-transfer, and privacy terms after Customer authorization. Status: Available after organization authorization. CVNexus does not send an agreement automatically; every send requires an authorized user, eligible document, governed PDF, and signer selection.

Intuit Inc. / QuickBooks Online Relationship: Optional customer-directed accounting connection. Purpose: Customer-directed QuickBooks Online OAuth authorization, selected-company verification, safe Vendor/Customer/Account discovery for deliberate identity mapping, and explicit creation of an eligible QuickBooks Bill from an approved CVNexus vendor invoice. Data: QuickBooks company and realm identifier, authorization metadata, granted accounting scope, token expiration, encrypted OAuth access and refresh credentials, limited CompanyInfo metadata, safe provider identifiers/names/account codes/contact email metadata used for mapping, and the approved vendor-invoice fields required to create a Customer-directed Bill. CVNexus does not run automatic or background accounting synchronization and does not store raw QuickBooks response payloads in the identity register. Processing location: Processed under Intuit’s service, infrastructure, data-transfer, and privacy terms. Status: Available after company-owner authorization and successful company verification. Owners must map the required QuickBooks Vendor and expense Account before explicitly sending an eligible approved vendor invoice as a Bill. The current controlled Bill workflow holds invoices with nonzero tax or retainage and does not automatically synchronize accounting transactions, payments, general-ledger balances, budgets, forecasts, or margins.

4. Base44 published downstream providers

Base44 provides the core application platform under its own Data Processing Addendum. Its published downstream list may change independently of CVNexus. The following snapshot is incorporated for transparency; the actual routing of a particular record depends on the Base44 features used and its current service architecture.

Mongo: Data storage and hosting; published processing country: United States.

SendGrid: Email transmission and external communication; published processing country: United States.

Langfuse: LLM logging; published processing country: Germany.

Logfire: General logging; published processing country: United Kingdom.

Render: Server services; published processing country: United States.

Google Cloud Platform: Analytics services; published processing country: United States.

OpenAI: LLM API calls when Base44 AI capabilities are used; published processing country: United States.

Anthropic: LLM API calls when Base44 AI capabilities are used; published processing country: United States.

Wix.com Ltd.: Providing and improving Base44 branded services; published processing country: Israel.

Supabase: Media hosting; published processing country: United States.

DataDog: General logging and monitoring; published processing country: United States.

5. Customer-directed integrations

The current production customer-directed integrations are Google Workspace and Microsoft 365 for controlled spreadsheet reporting and CRM email/calendar metadata synchronization, plus QuickBooks Online for company-owner OAuth authorization, selected-company verification, safe Vendor/Customer/Account discovery, deliberate mapping, and explicit creation of an eligible QuickBooks Bill from an approved CVNexus vendor invoice. They are not active by default and process only after an authorized company owner completes the provider consent flow. CRM synchronization is limited to metadata for provider records involving an existing CRM contact; email message bodies are not requested by the released workflow. The QuickBooks connection stores governed authorization/realm metadata and encrypted credentials, verifies limited CompanyInfo data, stages safe mapping metadata, and writes a Bill only after the owner deliberately invokes the controlled exchange and required Vendor and expense-Account mappings exist. It does not run automatic or background accounting synchronization, create payments, or overwrite CVNexus budgets, forecasts, margins, Cost Transactions, invoice approvals, or payment state. The current controlled Bill workflow holds invoices with nonzero tax or retainage until those accounting-liability mappings are governed. Adobe Acrobat Sign is available for customer-directed authorization, eligible commercial-document agreement sending, and agreement-status refresh; every send requires an authorized Adobe account, an approved or issued CVNexus commercial document, a governed PDF, and Customer-selected signer email addresses. Procore is separately limited to the Developer Sandbox unless live production activation is explicitly verified.

Customer is responsible for selecting the provider account and destination, reviewing requested scopes, maintaining third-party licensing, and disconnecting access when no longer required. CVNexus limits use to the scopes required by the released workflow and retains encrypted credential material only as needed to maintain an active authorized connection.