The short version
- Three kinds of provider touch personal data: Cloudflare (network), our hosting provider (servers) and our mail server.
- They see IP addresses, account data and encrypted traffic — never your file names or contents.
- App stores and our build service are not sub-processors for your data.
- We give 30 days’ notice before adding a new sub-processor.
1. About this list
A sub-processor is a third party that we, [Nexlla Creative Agency — registered legal name] (trading as Nexlla Creative Agency), engage to process personal data on our behalf. Each is bound by written terms that require it to protect the data, use it only to provide its service to us, and follow our instructions. They receive only what their task needs.
For organisations that have accepted our Data Processing Addendum, this page is Annex 3. For how we handle personal data generally, see our Privacy Policy; for transfer safeguards, see International transfers.
2. Current sub-processors
| Provider | Purpose | Data processed | Location | Status |
|---|---|---|---|---|
| Cloudflare, Inc. | DNS for dragy.nexlla.com; reverse proxy, TLS and DDoS protection in front of the website, app and API; public STUN service (stun.cloudflare.com) that helps devices discover a direct connection. |
IP addresses and request metadata of everyone who connects; the HTTPS traffic it proxies, including account data at sign-in and session tokens; transfer data that is already end-to-end encrypted (relay and uploads). For STUN, the IP addresses and ports involved in setting up a connection. | Global edge network; company based in the United States | To confirm |
| Hostinger (virtual private server) | Hosting the server that runs Dragy: account database, signalling, encrypted relay and temporary encrypted storage; server logs. | Account and device data, sessions (hashed), security activity log, stored encrypted transfers and their metadata, server and proxy logs including IP addresses. | [Hosting region — confirm] | To confirm |
| Self-hosted mail server (Mailcow) that we operate on the same server | Sending system emails: email confirmation, password reset, new sign-in alerts and password-changed notices. | Recipient email address; the email’s content (including one-time links and the name of a newly signed-in device); delivery logs. | [Same region as hosting — confirm] | To confirm |
Our relay and storage run on our own server at the hosting provider; no separate cloud-storage provider receives your encrypted files. [If backups of the account database are stored with a different provider, add it here.] To confirm
3. Independent providers (not sub-processors)
These companies are involved in getting Dragy to you, but they don’t process your Dragy data on our behalf:
| Provider | Role |
|---|---|
| Apple — App Store | Only when the iPhone and iPad app (coming soon) or a Mac App Store version is installed from it. Apple acts as an independent controller of the data it collects about your purchase and download. |
| Google — Google Play | Only if you install the Android app from Google Play once it is listed there. Today the Android app is downloaded directly from our website. Google acts as an independent controller of the data it collects. |
| Codemagic | Build service that compiles our mobile apps from our source code. It handles no user data. |
| Your browser, operating system and internet provider | Chosen by you and acting under their own terms. They may see that you use Dragy and the network traffic it creates (but not, thanks to encryption, its content). |
4. Change notifications
We will update this page at least 30 days before a new sub-processor starts processing personal data. If we must replace one urgently to protect the security or continuity of the service, we may give shorter notice and will explain why.
To be told about changes by email, write to [email protected] with the subject “Sub-processor updates” from the address you want us to use. You can unsubscribe by replying to any update.
5. Objections
If your organisation has accepted our Data Processing Addendum, you may object to a new sub-processor on reasonable data-protection grounds within the notice period by writing to [email protected]. We will discuss it in good faith. If we cannot resolve the objection, you may stop using the affected part of the service as set out in section 7 of the Addendum.
6. Changelog
- Initial list — October 20, 2026.
Questions about our sub-processors? Write to [email protected].