Subprocessors

1. What a subprocessor is & how we vet them

A subprocessor is a third-party company that processes personal data on Senova's behalf in order to help us deliver our service. When you use Senova, some of your data necessarily flows through these providers — for hosting, storage, AI generation, payments, and communications.

Before we engage a subprocessor, and on an ongoing basis, we apply the following controls:

• Data Processing Agreements (DPAs). We require a DPA (or equivalent contractual terms) with each subprocessor that binds them to confidentiality, purpose limitation, and appropriate security obligations, including terms for international data transfers where relevant.
• Security review. We evaluate each provider's security posture — certifications (such as SOC 2 or ISO 27001 where available), encryption in transit and at rest, access controls, and incident-response practices — before onboarding and periodically thereafter.
• Data minimization. We share only the data a subprocessor needs to perform its function, and we configure each integration to limit retention and scope wherever we can.

This page reflects our current, good-faith understanding of the providers we rely on. It is a draft pending legal review and may not yet be exhaustive.

2. Infrastructure & hosting subprocessors

These providers run the compute, network, database, and storage layers that keep Senova online.

3. AI & processing subprocessors

Senova's builder and assistant rely on AI providers to generate content in response to your prompts. Only the prompt and the content relevant to your request are sent for processing.

We do not permit our AI subprocessors to use your data to train their models except as needed to provide the service, consistent with their applicable terms.

4. Payments

Billing and payment processing are handled by Stripe. Senova does not store full card numbers; payment credentials are collected and processed directly by Stripe.

5. Email & communications

We use a third-party email delivery provider to send transactional messages such as account confirmations, security notices, and receipts.

6. Analytics

Analytics are off by default. We collect product analytics only if you consent. If you do not opt in, no analytics subprocessor receives your usage data. When enabled, analytics are configured to minimize personal data and are used solely to understand and improve the product.

7. Changes to this list & how we notify

As our infrastructure evolves, we may add, remove, or replace subprocessors. When we make a material change to this list, we will update the effective date and version at the top of this page.

To receive advance notice of changes — including the opportunity to object where your agreement provides for it — subscribe by emailing [email protected]. We aim to provide reasonable notice before a new subprocessor begins processing personal data.

8. Contact

Questions about this list, our subprocessors, or how your data is processed? Reach us at [email protected].