Skip to content
Get started

Subprocessors

Last updated: October 13, 2026

Overview

Novitora ("we", "us", "our"), operated by Uptraff Ltd, engages a small number of third-party service providers ("Subprocessors") to help us provide our file conversion platform at novitora.com. These Subprocessors may process personal data on our behalf in accordance with our Data Processing Agreement and applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR).

This Subprocessor List provides transparency about the third parties we engage, the nature of the processing they perform, and the safeguards we have in place to protect your data.

Important: We conduct due diligence on all Subprocessors before engagement and require each to enter into data processing terms that provide at least the same level of data protection as our own commitments to you.

Scope

This list covers all Subprocessors that may have access to or process personal data submitted through our file conversion services and our website.

Our engagement of Subprocessors is governed by:

  1. Article 28 of the UK GDPR and EU GDPR, which sets out requirements for processors engaging sub-processors
  2. Our Data Processing Agreement with customers
  3. Standard Contractual Clauses (SCCs) where data is transferred outside the UK or EEA
  4. The UK International Data Transfer Agreement (IDTA) where applicable

Data protection standards

All Subprocessors are required to:

  1. Process personal data only on our documented instructions
  2. Ensure that persons authorised to process personal data have committed themselves to confidentiality
  3. Implement appropriate technical and organisational security measures
  4. Assist us in responding to data subject access requests
  5. Delete or return all personal data at the end of the provision of services
  6. Make available all information necessary to demonstrate compliance with data protection obligations
  7. Allow for and contribute to audits and inspections

Current Subprocessors

The following table lists the Subprocessors currently engaged by Novitora. Each entry includes the Subprocessor's name, its purpose, the location of data processing, and the types of personal data processed.

Name Purpose Location Data Processed
DigitalOcean, LLC Cloud hosting, file storage, and Kubernetes compute that power file conversion EU (Frankfurt) Uploaded files, converted files, usage metadata, IP addresses
Modal Labs, Inc. On-demand GPU and CPU computing for our AI and rendering tools: background removal, speech-to-text and subtitles, image upscaling and enhancement, photo colourisation, watermark removal, AI photo editing, AI music generation, text-to-speech, and HTML and web page capture European Economic Area (processing is pinned to Modal's EU region and requests are routed through Dublin, Ireland); Modal keeps its service logs in the United States (transfers safeguarded by SCCs and the UK IDTA) Files, text, and web addresses submitted to these tools, including file names, and the results they produce
OpenAI OpCo, LLC Language model for our AI document tools (AI PDF Summarizer, PDF Translator, and Chat with PDF), reached through Cloudflare's AI Gateway United States (transfers safeguarded by SCCs and the UK IDTA) Text extracted from the document you submit, your questions, and the generated summary, translation, or answer
Google LLC (Google Cloud) Sign in with Google: the Google Cloud sign-in client that lets you create or open your account with a Google account, through Clerk. We may also run parts of the Service on Google Cloud computing in the EU; no files or document text are processed on Google Cloud at present, and we will update this entry and the Change Log before that changes United States for Sign in with Google; EU (Frankfurt) for any cloud computing (transfers safeguarded by SCCs and the UK IDTA) If you choose Sign in with Google: your Google account email address, name, and profile picture, and the sign-in request itself
Google Ireland Limited and Google LLC (Google Analytics and Google Tag Manager) Website analytics: how visitors use novitora.com, loaded only where the visitor's cookie choices allow analytics. Google signals, advertising features and data sharing with Google are switched off United States and Google's other data centres; for visitors in the UK, the EU and Switzerland, IP addresses are used there only to work out an approximate location and are then discarded (transfers safeguarded by the EU-US Data Privacy Framework and its UK Extension, and by the standard contractual clauses in Google's data processing terms) Random browser identifiers from the _ga cookies, pages visited (without query strings except campaign tags), the referring website, browser and device details, approximate location, and events such as a finished conversion or the type of a downloaded file; never file names or contents
Clerk, Inc. User authentication and account management United States (transfers safeguarded by SCCs and the UK IDTA) Email address, account and authentication identifiers, sign-in metadata
Cloudflare, Inc. Content delivery network (CDN), DNS, DDoS protection, web application firewall, bot protection (Turnstile), AI Gateway (relays requests from our AI document tools to the language model provider), AI Search (answers in our site search), and Web Analytics (aggregate page views and load times for visitors outside the European Union) Global edge network; origin configuration in the EU IP addresses, HTTP request metadata, security event logs, files and text passing through our website and API in transit, text submitted to our AI document tools, site search queries
PostHog, Inc. Error monitoring: reports of software errors in our website and its servers, so we can find and fix them. Product analytics: how visitors use our tools, from opening a tool to downloading the result, loaded only where the visitor's cookie choices allow analytics EU (Frankfurt). Data from your browser reaches PostHog through Cloudflare's global network, which PostHog uses to receive it on our own address. PostHog, Inc. is a United States company, and any access to the data from outside the EU is safeguarded by SCCs and the UK IDTA Error reports: error messages and stack traces, the page address without its query string, browser and operating system versions, screen size, language and time zone, and a random identifier for the page view (where the visitor has allowed analytics, the browser and visit identifiers below instead). Product analytics: random browser and visit identifiers from the ph_ cookie and browser storage, pages visited (without query strings except campaign tags), the referring website, browser and device details, and events such as an uploaded file, a finished or failed conversion or the type of a downloaded file; never file names or contents. No location, and IP addresses are not stored

How conversion runs: Most conversions are performed by open-source software that we run ourselves on DigitalOcean in Frankfurt. Those tools are not third parties and do not send your files outside our own infrastructure, so they are not listed as Subprocessors. The AI and rendering tools named in the Modal entry run on Modal's computing service, and the AI document tools use OpenAI's language model, which is why both are listed above.

Website analytics

We count visits with Umami, a privacy-friendly analytics tool that we host ourselves on our own infrastructure in the European Union (Frankfurt). Because it is self-hosted, Umami is not a Subprocessor. Google Analytics and PostHog, listed above, run beside it. All three load only where your cookie choices allow analytics; PostHog's error monitoring runs for every visitor.

For visitors outside the European Union, Cloudflare Web Analytics also measures page views and page load times in aggregate, using a script that reads your browser's performance data. Cloudflare states that it does not collect or use visitors' personal data. It is covered by the Cloudflare entry above.

Payments

Novitora is currently free to use and does not process any payments. We therefore engage no payment subprocessor and collect no payment card or billing information. If we introduce paid plans in future, this list will be updated to name any payment processor before any payment data is collected.

Data transfer mechanisms

Transfers within the UK and EEA

Where Subprocessors process data within the United Kingdom or European Economic Area, no additional transfer mechanism is required beyond our Data Processing Agreement.

Transfers outside the UK and EEA

Where personal data is transferred to Subprocessors located outside the UK or EEA, we rely on one or more of the following legal mechanisms:

  1. Adequacy Decisions: Where the UK Secretary of State or the European Commission has determined that the recipient country ensures an adequate level of data protection
  2. Standard Contractual Clauses (SCCs): EU-approved contractual terms that provide appropriate safeguards for international data transfers
  3. UK International Data Transfer Agreement (IDTA): The UK-specific mechanism for international transfers, as approved by the Information Commissioner's Office (ICO)
  4. UK Addendum to EU SCCs: Where we supplement EU SCCs with the UK Addendum to cover transfers from the UK

Transfer impact assessments

We conduct Transfer Impact Assessments (TIAs) for each Subprocessor located outside the UK or EEA to evaluate:

  1. The laws and practices of the recipient country regarding government access to data
  2. The technical and organisational measures implemented by the Subprocessor
  3. Any supplementary measures necessary to ensure an essentially equivalent level of protection
  4. The nature, scope, and purpose of the data transfer

Changes to Subprocessors

Adding new Subprocessors

Before engaging a new Subprocessor, Novitora will:

  1. Conduct a due diligence assessment of the prospective Subprocessor's data protection practices and security measures
  2. Ensure the prospective Subprocessor can meet our data protection requirements
  3. Put in place a data processing agreement with the prospective Subprocessor
  4. Implement appropriate transfer mechanisms where data will be processed outside the UK or EEA
  5. Conduct a Transfer Impact Assessment where applicable
  6. Update this Subprocessor List

Removing Subprocessors

When we cease using a Subprocessor, we will:

  1. Ensure all personal data held by the Subprocessor is securely deleted or returned
  2. Obtain confirmation of data deletion where feasible
  3. Update this Subprocessor List accordingly

Replacing Subprocessors

When we replace one Subprocessor with another, we will follow both the removal and addition procedures outlined above, ensuring continuity of data protection standards.

Notification process

How we notify you

We are committed to transparency regarding changes to our Subprocessor List. We provide notification of changes through the following channels:

  1. Website Update: This Subprocessor List page will be updated to reflect any changes, with the "Last Updated" date amended accordingly
  2. Email Notification: Where you hold an account, we aim to give reasonable advance notice by email before a new Subprocessor begins processing your personal data

Notification content

Each notification will include:

  1. The name and location of the new Subprocessor
  2. A description of the processing activities to be performed
  3. The categories of personal data that will be processed
  4. The data transfer mechanisms in place
  5. The effective date of the change

Objection rights

Your right to object

In accordance with our Data Processing Agreement and applicable data protection law, you have the right to object to the engagement of a new Subprocessor.

Objection process

  1. Submit your objection in writing to legal@novitora.com within 14 days of notification of the proposed change
  2. Provide reasons for your objection, including any specific data protection concerns
  3. We will acknowledge your objection within a reasonable period
  4. We will work with you in good faith to address your concerns, which may include providing additional information about the Subprocessor's data protection measures, implementing additional safeguards, or offering an alternative arrangement

Resolution

If we are unable to resolve your objection within a reasonable period, either party may terminate the affected services in accordance with our agreement. We will not engage the objected-to Subprocessor for processing your personal data until the objection is resolved or the notice period has expired.

Security measures

Subprocessor security requirements

All Subprocessors are contractually required to maintain security measures that include, at a minimum:

  1. Encryption of personal data in transit and at rest
  2. Access controls and authentication mechanisms
  3. Regular security assessments
  4. Incident response and breach notification procedures
  5. Physical security measures for data centres

Our oversight

We maintain ongoing oversight of our Subprocessors through:

  1. Periodic security reviews
  2. Review of any SOC 2 Type II reports, ISO 27001 certifications, or equivalent that a Subprocessor makes available
  3. Monitoring of security advisories and incident reports
  4. Contractual audit rights

Data retention by Subprocessors

General retention principles

Subprocessors are instructed to retain personal data only for as long as necessary to fulfil the purpose for which it was provided, governed by:

  1. Our data processing terms with each Subprocessor
  2. The nature and purpose of the processing
  3. Applicable legal and regulatory requirements
  4. Our own data retention policy

File processing data

Files uploaded for conversion are processed and then automatically deleted from our systems, including any Subprocessor systems, within 2 hours of upload for anonymous conversions and within 24 hours for authenticated API workspaces. Users may also manually delete their files sooner at any time.

Modal does not store the requests and responses that carry files to and from our AI and rendering tools. The one exception to the 2-hour deletion is OpenAI: text sent through our AI document tools is not used to train OpenAI's models, but OpenAI may keep it for up to 30 days for abuse monitoring before deleting it.

Change log

Date Change
13 October 2026 Extended the PostHog, Inc. entry to product analytics, which runs only where your cookie choices allow analytics, with data stored in the EU (Frankfurt).
12 October 2026 Added PostHog, Inc. for error monitoring of our website and its servers, with reports stored in the EU (Frankfurt); reports from your browser reach PostHog through Cloudflare's network.
12 October 2026 Added Google Ireland Limited and Google LLC (Google Analytics and Google Tag Manager) for website analytics, which runs beside Umami, the analytics tool we host ourselves.
9 October 2026 Corrected the website analytics note: Umami does not run, and Cloudflare Web Analytics, part of the Cloudflare entry, measures page views and load times for visitors outside the European Union. No Subprocessor was added or removed.
8 October 2026 Added Modal Labs, Inc. (computing for our AI and rendering tools) and OpenAI OpCo, LLC (language model for our AI document tools). Extended the Cloudflare entry to cover AI Gateway, AI Search, and files in transit. Updated the Google Cloud entry: it now covers Sign in with Google, and no files are processed on Google Cloud at present.

Archived Subprocessors

The following Subprocessors were previously engaged by Novitora but are no longer active. They are listed here for historical reference.

Name Purpose Date Removed Confirmation of Data Deletion
— — — —

No Subprocessors have been archived at this time.

Contact

If you have questions about our Subprocessors, wish to exercise your objection rights, or require further information about our data processing arrangements, please contact us:

Data Protection Enquiries

  • Email: legal@novitora.com
  • Address: Uptraff Ltd, 124 City Road, London, England, EC1V 2NX

For urgent data protection matters:

We aim to respond to all enquiries within a reasonable timeframe.