Subprocessors
This page lists the third-party subprocessors and service providers Novella uses to operate, secure, analyze, and support our website and customer feedback platform.
Novella uses a limited number of trusted third-party providers to deliver the Services. These providers may process personal data only where necessary for the purposes described below and are subject to appropriate contractual, confidentiality, and data protection obligations.
For more information about how Novella processes personal data, please see our Privacy Policy.
1. Overview
The list below covers providers supporting the customer feedback platform as well as our website, marketing, and customer support. Their role depends on the service and data involved. Providers used for Novella's own business activities are not necessarily subprocessors of customer-controlled survey data. Novella remains responsible for its subprocessors under applicable data processing agreements.
Novella's main application is hosted on Hetzner infrastructure, managed through Sliplane. Novella uses SiteGround to host Node.js applications.
Respondents are people who answer a customer's surveys or interact with its feedback widgets. Novella users are account holders and workspace members who create surveys and use the application. Website visitors visit Novella's marketing website, documentation, the Novella Library, demonstrations, or status page. The scope column distinguishes submitted feedback from account data, user-authored survey configuration, and technical metadata. A provider may process data from more than one group.
Personal data can also appear in survey setup text, uploaded assets, support requests, or notification content entered or configured by a customer. A scope limited to configuration or technical metadata does not mean that personal data can never be present.
2. Subprocessors and service providers
Providers are grouped by their primary purpose. Some providers support more than one function; each entry describes its full scope.
- Hosting
- Security and content delivery
- CRM and scheduling
- Marketing and website analytics
- Platform analytics and operations
- Billing and payments
- Communications and support
- AI assistance
Hosting
| Subprocessor | Purpose | Data processed | Whose data / scope | Location / safeguards |
|---|---|---|---|---|
| Hetzner | Hosting infrastructure for the application, including application and database services. | Account data, configuration data, survey and response data, uploaded assets, logs, and related technical metadata. | Both respondents and Novella users: application, database, asset, and operational data. | EU hosting; subject to applicable data protection terms. |
| Sliplane | Deployment and hosting management for the application running on Hetzner infrastructure. | Deployment configuration, operational logs, and service data accessible as necessary to manage and support the hosting environment. | Both respondents and Novella users: service data and logs accessible for hosting operations. | Subject to applicable data protection terms and transfer safeguards where required. |
| SiteGround | Hosting Novella's Node.js applications, including content delivery and hosting operations. | Hosted application content and data, information submitted to those applications, and operational and access logs, including IP addresses, requested URLs, timestamps, and browser and device metadata where logged. | Visitors and users of Novella's Node.js applications hosted on SiteGround: data processed by the relevant hosted application and related technical metadata. Respondent or Novella user data is processed only where handled by a SiteGround-hosted application. | EU hosting; subject to applicable SiteGround data processing terms and transfer safeguards where required. |
Security and content delivery
| Subprocessor | Purpose | Data processed | Whose data / scope | Location / safeguards |
|---|---|---|---|---|
| Cloudflare, Inc. | Image storage and delivery through Cloudflare R2 and the Novella CDN; spam, abuse, and automated activity prevention through Cloudflare Turnstile, using invisible mode. | Uploaded logos and background images, asset request metadata, IP addresses, device and browser information, interaction data, and security verification signals. | Website visitors, respondents, and Novella users: image delivery request metadata (including website logos and favicons) and security verification signals where Turnstile is used; uploaded assets may contain personal data. | Protected by applicable Cloudflare data protection terms and transfer safeguards where required. |
CRM and scheduling
| Subprocessor | Purpose | Data processed | Whose data / scope | Location / safeguards |
|---|---|---|---|---|
| HubSpot, Inc. | Novella's CRM, forms, and customer communications. Customer-enabled CRM syncing is described separately below. | Business contact details, form submissions, customer communications, and related technical metadata. | Novella users and website visitors: CRM, communications, and form data. Respondent response syncing only through a customer-enabled integration (section 3). | Data stored in the EU; protected by a data processing agreement and appropriate transfer safeguards where required. |
| Cal.com, Inc. | Scheduling demos, sales meetings, onboarding sessions, and other customer meetings. | Names, email addresses, meeting dates and times, booking responses, and any additional information submitted when scheduling; automatically collected request and technical metadata, including IP addresses, browser and device details, referring URLs, pages viewed, and timestamps. | Visitors to Novella's booking pages, including prospects, customer contacts, and Novella users, whether or not they complete a booking. Survey responses are not part of the intended processing. | EU hosting; subject to applicable data protection terms and appropriate transfer safeguards where required. |
Marketing and website analytics
| Subprocessor | Purpose | Data processed | Whose data / scope | Location / safeguards |
|---|---|---|---|---|
| Axeptio | Cookie consent management and preference controls on Novella's website and application. | Consent choices, consent records, and related technical metadata. | Website visitors and Novella users: cookie preferences and related technical data. | Subject to applicable data protection terms and transfer safeguards where required. |
| Plausible Insights OĆ | Privacy-friendly website analytics and performance measurement. | Website usage events and aggregated analytics data. | Website visitors, Novella users, and respondents visiting hosted surveys: usage and technical analytics data. | EU-based provider; processed under appropriate contractual safeguards. |
| Microsoft Corporation / Microsoft Clarity | Website behavior analytics, session replay, heatmaps, and performance measurement where permitted by consent. | Website usage events, device and browser information, interaction data, and related technical metadata. | Website visitors and Novella users on pages where enabled and consented: behavior and technical data. Submitted survey responses are not part of its intended purpose. | Used only where legally permitted; protected by appropriate contractual and transfer safeguards where required. |
| NextRoll, Inc. / AdRoll | Marketing measurement and retargeting on the website where permitted by consent. | Cookie or advertising identifiers, device and browser information, and website interaction data. | Website visitors and Novella users on pages where enabled and consented: advertising and interaction data. Submitted survey responses are not part of its intended purpose. | Used only where legally permitted; protected by appropriate transfer safeguards where required. |
| Storylane | Interactive product demonstrations on the website. | Demo interaction data, device and browser information, request metadata, and any contact details submitted through a demo. | Website visitors and demo users: demo engagement and submitted contact data. No production survey responses. | Subject to applicable data protection terms and transfer safeguards where required. |
Platform analytics and operations
| Subprocessor | Purpose | Data processed | Whose data / scope | Location / safeguards |
|---|---|---|---|---|
| Tinybird | Survey and website widget event ingestion, analytics, aggregation, and reporting. | Survey and workspace identifiers, visitor and session identifiers, interaction events, ratings, timestamps, attribution data, and related technical metadata. | Respondents: survey/widget interactions and ratings. Novella users: workspace identifiers used for reporting. | Subject to applicable data protection terms and transfer safeguards where required. |
| LaunchDarkly | Feature flag management, targeted rollout of application functionality, and A/B testing in the application. | User identifiers, names and email addresses where included, workspace identifiers, user roles, anonymous browser identifiers, feature evaluation events, experiment assignments, and interaction events used to measure A/B test results. | Novella users: account, feature usage, and A/B testing data; anonymous browser contexts where used, including on authentication pages. No submitted survey responses. | Subject to applicable data protection terms and transfer safeguards where required. |
| Bugsnag, Inc. | Error monitoring, crash reporting, diagnostics, and application reliability improvements. | Error logs, stack traces, device and browser metadata, user or account identifiers, and related diagnostic information. | Both respondents and Novella users: diagnostics and performance metadata from application and survey pages; request metadata may contain identifiers. | Protected by a data processing agreement and appropriate transfer safeguards where required. |
Billing and payments
| Subprocessor | Purpose | Data processed | Whose data / scope | Location / safeguards |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing, billing, invoicing, fraud prevention, and subscription management. | Billing contact details, payment identifiers, transaction details, invoice records, and related fraud or compliance data. | Novella users and billing contacts: payment and subscription data. No survey responses. | Protected by a data processing agreement and appropriate transfer safeguards where required. |
Communications and support
| Subprocessor | Purpose | Data processed | Whose data / scope | Location / safeguards |
|---|---|---|---|---|
| Mailgun Technologies, Inc. | Transactional email delivery, email routing, deliverability, and related email service operations. | Email addresses, message metadata, delivery status, and email content necessary to send service communications. | Novella users: service email delivery. Website visitors submitting a Libby contact form: name, email, company if supplied, inquiry, source page and conversation text only if selected for inclusion, sent in an internal team notification. Respondent data may be included in feedback notification or digest email content. | Protected by a data processing agreement and appropriate transfer safeguards where required. |
| ProductLift | Knowledge base and support documentation, product updates and changelog publishing, and feature request collection and management. | Business contact details, documentation and changelog interaction data, user feedback, comments, votes, feature requests, and related product engagement data. | Novella users and documentation visitors: support and product engagement data; respondent data only if included in user-submitted content. | Protected by appropriate contractual, confidentiality, and data protection safeguards. |
| Incident.io | Incident status page hosting and email notifications for people who subscribe to incident updates. | Status page visitor request metadata, such as IP address, device and browser metadata, and access logs; email addresses, subscription preferences, and incident update delivery metadata when someone subscribes to incident updates by email. | Status page visitors and subscribers, including Novella users or respondents who visit or subscribe. No survey responses. | Protected by appropriate contractual, confidentiality, and data protection safeguards. |
AI assistance
| Subprocessor | Purpose | Data processed | Whose data / scope | Location / safeguards |
|---|---|---|---|---|
| Mistral AI | Optional AI survey writing, description generation and separate tag suggestions when a Novella user requests them in the survey creation wizard or editor. | Current survey name, main and follow-up questions, language, survey type and channel, scale configuration, endpoint labels and score-to-sentiment mapping. Writing requests also include the description and thank-you text, relevant greeting templates, navigation and feedback-button labels, comment placeholders, enabled thank-you action labels and destinations, and optional saved brand context (organisation, audience, tone of voice and terminology/preferences). Users can exclude brand context before generation; description and tag requests do not use it; description requests include thank-you text. Tag requests include the description and existing workspace tag IDs, labels and sentiments. | Novella user-authored survey configuration. These requests exclude respondent records, submitted responses, respondent contact fields, and Novella account profile fields. Personal data entered into configuration text or tag labels may still be processed. | Subject to the applicable Mistral AI commercial terms and Data Processing Addendum. Processing location, retention, and training use depend on the selected service, account settings, and agreement. |
| Mistral AI (Libby chat) | Generate answers to visitor questions using published Library guides when AI chat is enabled. | The submitted question, up to six recent conversation messages, relevant published guide passages and generated answers. Messages may contain personal data entered by the visitor. | Library chat visitors. No account is required. Customer survey responses, respondent records and account profiles are not automatically included. | Subject to the applicable Mistral AI commercial terms and Data Processing Addendum. Processing location, retention and training use depend on the selected service, account settings and agreement. Local browser-history deletion does not delete provider-held data. |
3. Customer-enabled integrations
Customers may choose to connect Novella with HubSpot, Slack, Microsoft Teams, Zapier, email tools, or other systems. Depending on the integration, shared data may include survey responses, ratings, comments, respondent details, CRM identifiers, and related metadata.
Customers may also import images from Google Drive, Dropbox, Microsoft OneDrive, or SharePoint into the Media Library. These imports involve the selected files and associated file metadata. Pexels provides optional stock-photo search and importing for survey backgrounds; this feature does not require sending survey responses to Pexels.
These services are enabled by the customer and are subject to the customer's arrangements with the relevant provider. Their data protection role depends on the integration and applicable agreements. The customer controls which integrations to enable and the data shared through them. Novella's obligations under applicable data processing agreements continue to apply.
Response integrations (such as HubSpot, Slack, Microsoft Teams, and Zapier) can receive respondent data when enabled and configured by a Novella user. They may also process the connecting Novella user's account, authorization, and connection metadata. Image import integrations process the selected files and file metadata, together with authorization and request data where applicable; they do not require sending respondent records or submitted survey responses. Files selected by a user may themselves contain personal data.
Customer responsibility: If you connect Novella to another service, review that service's privacy and security terms before syncing personal data or respondent feedback.
4. Updates to this list
Novella may update this page when we add, replace, or remove subprocessors. Material changes will be reflected on this page, and where required by contract or applicable law, we will provide additional notice.
5. Contact
If you have questions about Novella's subprocessors or need more detail for vendor review, please contact us at [email protected].