Third-party service providers NivaDesk may use to host, operate, secure, support and improve the service, including infrastructure, payments, analytics, diagnostics and support providers.
Last updated: 15 November 2026
NivaDesk is operated by EGGCRAFT LIMITED.
This Subprocessors page explains the third-party service providers that NivaDesk may use to host, operate, secure, support, and improve the NivaDesk service.
This document supports our Privacy Policy, Terms of Service, Security Overview, and Data Processing Agreement. It lists the core providers we use or may use to operate NivaDesk, depending on the features enabled for a customer.
NivaDesk is operated by EGGCRAFT LIMITED, 141d Randolph Avenue, London, W9 1DN, United Kingdom.
For privacy, data protection, or subprocessors questions, contact us at: contact@nivadesk.co.uk.
A subprocessor is a third-party service provider that may process personal data on behalf of NivaDesk in order to help us provide our service to customers.
For example, NivaDesk may use cloud infrastructure to store workspace data, authentication providers to manage login, payment providers to process subscriptions, or email providers to send account and service emails.
We aim to use trusted providers that support reasonable security, reliability, and privacy standards.
We only allow subprocessors to process personal data for the purposes needed to provide their services to us. We do not sell personal data. We do not use workspace content, client files, order records, or private business data for advertising to customers.
Where required, we enter into appropriate contracts with subprocessors, including data processing terms and confidentiality obligations.
Depending on the service and feature used, subprocessors may process limited categories of data such as:
These providers process personal data that our customers keep in their NivaDesk workspaces, on our behalf, for the purposes shown for each. A provider marked "on trial" processes data only for the workspaces where we have turned that feature on.
Purpose: hosting, the database (Cloud Firestore), file storage, server functions, sign-in (Firebase Authentication), push notifications (Firebase Cloud Messaging), malware scanning of uploaded files, server logs and database backups.
Data: the content of your workspace, uploaded files and their metadata, the text of notifications, and technical logs.
Location: the database, file storage, server functions, malware scanning and database backups are in Google Cloud's London region (europe-west2); sign-in runs in the United States, and push messaging and server logs run on Google's global infrastructure, including the United States.
Purpose: reading the text of receipts and documents you upload or attach, to match them to bank transactions.
Data: the images of those receipts and documents.
Location: Google's global infrastructure.
Role: a Google service, provided under Google's terms, that our Android app uses to show PDF previews.
Purpose: showing a preview when you open a PDF file in our Android app; Google receives a link to the file and opens the file to display it.
Data: the PDF files you preview in the Android app.
Location: Google's global infrastructure.
Purpose: sending e-mails, including the e-mails NivaDesk sends to your customers when you use features that send them (for example order status updates and booking confirmations).
Data: names, e-mail addresses, e-mail content and delivery logs.
Location: Hostinger's data centres; e-mail is stored in Europe (France and Germany).
Purpose: the network in front of the pages your customers open from NivaDesk links (customer pages, tracking, estimates, files and payment pages), on nivadesk.app addresses and on your own custom domain.
Data: IP addresses and request data of the people who open those pages.
Location: Cloudflare's global network, including the United States.
Purpose: following parcels so that NivaDesk can show delivery status.
Data: tracking numbers and carrier codes only.
Location: 17TRACK's servers in the United States; 17TRACK operates from Singapore and China.
Provider: Twilio Ireland Limited, our contracting party; messages are processed by Twilio Inc.
Purpose: sending text messages to your customers about their orders, where your workspace switches this feature on.
Data: your customer's phone number and the message (your business name, the stage of the order, a link to your customer's order page and a link to stop texts, or, for the first text, a link to confirm). Twilio's copy of each message is deleted 30 days after it is sent, and may remain in Twilio's internal systems for up to 30 more days.
Location: United States. Twilio states that it is certified under the UK Extension to the EU-U.S. Data Privacy Framework; its data protection terms also include the UK International Data Transfer Addendum to the Standard Contractual Clauses.
Purpose: receiving and sending your customers' WhatsApp messages in the customer inbox, and sending the order updates your workspace switched on.
Data: your customers' phone numbers and WhatsApp profile names, the messages, photos and files exchanged, and for an order update the customer's first name, your business name, the order's number and stage, and the link to the order page.
Location: Meta's global infrastructure, including the United States.
These providers support the processing NivaDesk does for itself as a controller: accounts and sign-in, our website and apps, billing, support and our own help assistant. Their role differs, as shown for each.
Role: our service provider, as in section 5, for accounts, sign-in, our website (hosted in Google Cloud's London region) and our own records.
Purpose: measuring how our iPhone, iPad, Mac and Android apps are used, and measuring our own app advertising.
Data: an app instance identifier, device and app information, usage events and, where the device allows it, its advertising identifier.
Location: Google's global infrastructure, including the United States.
Role: Google provides it under the reCAPTCHA terms that apply to our use.
Purpose: telling people from automated abuse on our website and web app.
Data: device and browser data, IP address and interaction data.
Location: Google's global infrastructure, including the United States.
Purpose: our own mailboxes, such as contact@nivadesk.co.uk, the e-mails we send about accounts, invitations and support, and a standby copy of our website.
Data: names, e-mail addresses and e-mail content.
Location: Hostinger's data centres; e-mail is stored in Europe (France and Germany).
Purpose: domain name services for our domains, and the copy of our help pages at docs.nivadesk.app.
Data: IP addresses and request data.
Location: Cloudflare's global network, including the United States.
Role: our service provider.
Purpose: writing the answers of our website chat and of the help assistant in NivaDesk. This is separate from ChatGPT, and from Quick Reply, which uses your own OpenAI key (section 5B).
Data: the questions and messages written in the chat or the assistant, and the parts of our guide needed for the answer.
Location: the United States and other countries where OpenAI's providers operate.
Role: Stripe processes payments for NivaDesk's web subscriptions; it acts as an independent controller for payment processing and as our processor for some billing services, as set out in Stripe's data processing terms.
Data: billing contact details, such as the workspace owner's e-mail address and the workspace name, invoices and subscription data; NivaDesk never receives full card numbers.
Location: Stripe's global infrastructure, including the United States.
Role: Apple sells and manages subscriptions bought in the App Store under its own terms and privacy policy; it also provides Sign in with Apple, app attestation and push notifications on Apple devices.
Data: the identifiers and subscription status Apple shares with us, push tokens and the text of notifications delivered to Apple devices.
Location: Apple's global infrastructure.
Role: Google sells and manages subscriptions bought on Google Play under its own terms and privacy policy, and provides Google sign-in and Play Integrity checks.
Data: the identifiers, profile details and subscription status Google shares with us.
Location: Google's global infrastructure.
Role: Shopify bills subscriptions bought through the NivaDesk app in the Shopify App Store under its own terms.
Data: the store identifier and subscription status Shopify shares with us.
Location: Shopify's global infrastructure.
When you or your workspace owner connect another service using your own account, NivaDesk sends data to that service or receives data from it on your instructions, only for the feature you use. You choose these services and have your own agreement with them; they handle the data under that agreement and their own terms and privacy policies, for example as your processor or as an independent controller. NivaDesk does not engage them as its subprocessors; if NivaDesk itself uses one of these providers to process your data, it is listed in section 5.
These services include:
Core infrastructure providers are necessary to operate NivaDesk. They may support account authentication, database storage, file storage, serverless functions, hosting, app sync, backup, and security controls.
Because these providers are needed for the service to work, users cannot usually opt out of core infrastructure processing while continuing to use NivaDesk.
Payment providers process subscriptions, renewals, invoices, receipts, refunds, tax information, fraud checks, and payment status.
If you subscribe through Apple App Store or Google Play, your payment relationship may be with Apple or Google. If you subscribe through our website, payment may be processed through Stripe or another payment provider.
NivaDesk does not store full card numbers on its own systems.
We may use analytics and diagnostics providers to understand how the website and product are used, measure performance, fix bugs, and improve reliability.
Where required by law, non-essential analytics or marketing cookies will only be used after consent. Analytics should not be used to inspect private workspace content, uploaded files, or customer records for advertising purposes.
We may use email, help desk, or customer support providers to respond to support requests, send account messages, deliver billing notices, and provide service-related updates.
Please avoid sending unnecessary sensitive information in support messages unless it is needed to resolve your request.
Some subprocessors may process data outside the United Kingdom or European Economic Area.
Where required, we use appropriate safeguards for international transfers, such as adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement, or other lawful transfer mechanisms.
NivaDesk may add, replace, or remove subprocessors as our service develops.
We will update this page when material subprocessors change. Business customers that have a Data Processing Agreement with us may have additional notification rights as described in that agreement.
If you have concerns about a new subprocessor, contact us at contact@nivadesk.co.uk.
Customers are responsible for deciding what personal data they add to NivaDesk and ensuring they have the right to process that data.
If you use NivaDesk to manage your own clients, customers, suppliers, contractors, employees, or other third parties, you are responsible for providing any privacy notices or consent required by law.
You should only upload files and data that are necessary for your business use and should avoid storing unnecessary sensitive information.
If you have questions about this Subprocessors page, our providers, or how NivaDesk processes data, please contact:
EGGCRAFT LIMITED
141d Randolph Avenue
London
W9 1DN
United Kingdom
Email: contact@nivadesk.co.uk
