Ecodia • Legal

Subprocessors & Data Locations

This page lists third-party service providers (“subprocessors”) that process personal information on Ecodia’s behalf, along with purposes, data categories, regions, and links to their data protection terms.

Last Updated: 24 February 2026
Change notifications. We will update this page for material changes (additions, removals, or purpose/region changes) and may notify admins by email or in-product banners where appropriate.

Current List

12 of 13 listed
NamePurposeData CategoriesRegionsStatusDPA / Terms
Hosting for public frontends (Next.js) and global edge delivery.
Frontend hostingCDN/edge cachingBuild pipeline
Account metadataPublic site contentLogs/diagnostics
GlobalUSEU
activeView terms ↗
Primary backend (Ecodia APIs, Alive) in australia-southeast1; storage configured AU-first where practical.
Backend hostingObject storageContainer registrySecretsOps logsCI build
Account metadataOperational dataLogs/diagnosticsUploaded media
AustraliaGlobal
activeView terms ↗
DNSDDoS protectionEdge caching
IP addressesHTTP request metadataLogs/diagnostics
Global
activeView terms ↗
Card data handled by Stripe; Ecodia does not store full card PAN.
PaymentsBilling
Payment metadataBilling contactTransaction records
USGlobalEU
activeView terms ↗
SES with DKIM for domain sending; region may vary by SES configuration.
Transactional email
Email addressesMessage metadataDelivery logs
GlobalUSAPAC
activeView terms ↗
Self-hosted; data residency aligned to AU. Aura not used in prod.
Graph database
Operational dataEducation/EYBA entitiesMetadata
Australia
activeView terms ↗
Used for weather features; requests may include lat/lon derived from user-provided location.
Weather probe / geocoding for forecasts
Coarse location (derived)Forecast responses
EUGlobal
activeView terms ↗
Configured with no-training controls for user data; exclude student PI from foundation model training.
AI/LLM features
Prompt contentDe-identified contextModel outputs
USGlobal
activeView terms ↗
Leaflet basemap usage; requests for map tiles go to third-party tile endpoints.
Map tiles
IP addressesHTTP request metadata
Global
activeView terms ↗
Map tiles / basemaps
IP addressesHTTP request metadata
GlobalUSEU
activeView terms ↗
Map tiles / satellite basemaps
IP addressesHTTP request metadata
Global
activeView terms ↗
Used for Google sign-in; minimal profile scope.
Authentication (OAuth)
Email addressProfile info (with consent)Auth tokens
Global
activeView terms ↗

Note: Regions listed reflect where your workloads are configured and where a vendor may process or store data for those workloads. Some vendors offer regional controls; Ecodia configures AU-first where practical for Australian users.

Change Log

  • 24 October 2025
    v1.0.0
    Initial publication: Vercel, Google Cloud (Run/Storage/Logging/Secrets/Build), Cloudflare, Stripe, AWS SES, Sentry (pending), Neo4j self-hosted (AU), Open-Meteo, OpenAI (active), OSM/bagO/Esri tiles.

For advance notice of material changes, admins may receive email or in-product notifications.