Privacy and data
Sub-processors
Every third party that touches your data to keep WeGrowNepal running, what each one does, and where.
- Version
- v1.0
- Effective
- Contents
- 5 sections · 15 clauses
- Document ref.
- WGN-LEGAL-SUBP-V1.0
The PDF is a watermarked controlled copy. If it differs from this page, this page governs.
At a glance
A plain-language summary. The numbered clauses below are what legally applies.
- Seven providers, each doing one job.
- Your notes and files are stored in Mumbai, India.
- None of them may use your data for anything except the job we engaged them for.
- No advertiser, data broker or analytics company is on this list, because we use none.
1. What a sub-processor is
- 1.1
A sub-processor is a company we engage that handles personal data in the course of providing WeGrowNepal — a hosting provider, a storage provider, a company that delivers an email or a push notification.
Why this is here
It is not every company we buy something from. A supplier who never touches user data is not on this list and does not need to be.
- 1.2
Each is bound to process data only on our instructions, only for the purpose engaged, and to protect it to a standard no lower than our own.
- 1.3
This list is maintained as the list changes. Where a change materially affects how data is handled, it is announced rather than made quietly.
2. Hosting and storage
- 2.1
Amazon Web Services — application hosting and file storage. Notes, attachments, avatars and files kept in My Pocket are stored in the ap-south-1 region, which is Mumbai, India.
Why this is here
Mumbai is the nearest AWS region to Nepal, which is why it was chosen: it is the difference between a note opening quickly on a Nepali connection and not.
- 2.2
MongoDB Atlas — the database holding accounts, notes metadata, community posts, comments and settings.
- 2.3
Vercel — hosting and content delivery for wegrownepal.com.
3. Delivery
- 3.1
Expo — delivers over-the-air updates to the app, and carries push notifications to the platform services below.
- 3.2
Google, through Firebase Cloud Messaging — delivery of push notifications to Android devices.
Why this is here
A device token, the notification title and its body pass through this service. The content of a note never does.
- 3.3
Apple, through the Apple Push Notification service — delivery of push notifications to iOS devices.
- 3.4
Hostinger — delivery of the email we send: verification codes, password resets and account notices.
4. What is not on this list
- 4.1
No advertising network, data broker, or behavioural analytics provider is engaged, because none is used. There is no advertising in WeGrowNepal and no tracking for advertising purposes.
- 4.2
No error-monitoring service currently receives data. The application contains the client library for one, but it is not configured and transmits nothing.
Why this is here
Stated rather than omitted because the library is discoverable by anyone who looks, and finding it unlisted would reasonably suggest a concealed processor.
- 4.3
No provider on this list is permitted to use your data to train a model, and no such use is made by us.
5. Objecting to a sub-processor
- 5.1
If you object to a provider on this list, write to legal@lacspace.com setting out the objection.
- 5.2
We cannot ordinarily offer the Service without hosting, storage and delivery providers, so the practical remedy where an objection cannot be resolved is deletion of your account, which is available at any time from within the app.
Why this is here
Saying so plainly is more use than implying a choice that does not exist.
Version history
Every change to this document is recorded here, so amendments can be inspected rather than taken on trust.
v1.0 ·
- First published, resolving a reference in the Privacy Policy to a document that did not yet exist.
- Seven providers listed, each verified against the running system.