Sub-processors
Nimblet, a product of YOYABA GmbH, engages the third-party sub-processors below to operate the service. Each is bound by a data processing agreement consistent with Art. 28 GDPR. Where a sub-processor processes personal data outside the EU/EEA, the transfer is safeguarded as noted. This list is kept current; material changes are reflected here before a new sub-processor begins processing.
| Sub-processor | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd. / Google LLC) | Application hosting, PostgreSQL database, object storage for media assets, secret management | All service data at rest: account data, connected ad-account data, creative media, derived analysis | EU (region europe-west1); parent entity US | Google Cloud DPA incl. EU Standard Contractual Clauses |
| Google (Google Ireland Ltd. / Google LLC) | Sign-in via Google OAuth | Name, email address, profile picture | US | EU Standard Contractual Clauses |
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | Syncing your connected Meta ad-account data and public Ad Library data | OAuth access token, ad-account identifiers (outbound); campaign, ad and creative data plus aggregate performance and conversion counts (inbound) | US | EU Standard Contractual Clauses (Meta Data Processing Terms) |
| LinkedIn Ireland Unlimited Company / Microsoft Corp. | Syncing your connected LinkedIn ad-account data and public Ad Library data | OAuth access token, ad-account identifiers (outbound); campaign, ad and creative data plus aggregate performance and conversion counts (inbound) | US | EU Standard Contractual Clauses |
| OpenRouter, Inc. | AI model gateway for creative analysis and Ideation generation (bring-your-own-key) | Ad creative image URLs, ad copy, brand assets and context, and the prompts you submit | US | EU Standard Contractual Clauses |
| Firecrawl (Sideguide Technologies, Inc.) | Scraping public competitor ad-library and website pages | Public URLs only - no customer personal data | US | EU Standard Contractual Clauses |
| Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.) | Payment processing, subscription billing, and invoicing for paid plans | Billing contact (name, email), payment method details (entered directly with Stripe, never stored by us), subscription and invoice data | EU (Ireland); parent entity US | Stripe DPA incl. EU Standard Contractual Clauses |
| Resend, Inc. | Transactional email delivery (invitations, password resets, waitlist and billing notifications) | Recipient name and email address, email content incl. account links | US | EU Standard Contractual Clauses (Resend DPA) |
AI model routing
OpenRouter is a gateway that forwards requests to an underlying AI model provider. The specific model - and therefore the underlying provider - is configurable per workspace, so the effective downstream processor depends on your selection. AI features are bring-your-own-key: they run only when your workspace supplies its own OpenRouter API key. If your organization requires the AI provider to be limited to specific models or regions, contact us before enabling AI features.
Data Protection Officer
Our external Data Protection Officer, Mauß Datenschutz GmbH (Hamburg, Germany), acts as an independent recipient of certain data in a DPO capacity and is not a sub-processor of the service.
Last updated: 2026-07-22