Sub-processors
To run next2u we rely on a small number of carefully selected third-party providers ("sub-processors") that process personal data on our behalf, under our instructions, and in accordance with Article 28 GDPR. This page lists every sub-processor that may process your personal data, what it is used for, the data involved, and where that data is handled. It forms part of our Privacy Policy.
Active sub-processors
| Sub-processor | Purpose | Data categories | Location and transfer safeguard |
|---|---|---|---|
| OpenAI | AI content moderation, automatic translation, search relevance and listing-creation assistance | Listing text, uploaded photos, username, profile picture, search queries | United States (DPA + SCCs) |
| PostHog | Product analytics and feature flags (only with your consent) | Usage and interaction events, session and device identifiers, IP address | European Union |
| Sentry | Detection and diagnosis of technical errors | Error reports, technical request context, IP address | European Union (Germany) |
| Online Payment Platform | Payment processing, escrow and payouts for orders and paid features | Payment-method details (entered on their systems), transaction amounts, billing name, email and address; for sellers also date of birth, address, identity documents, tax identification number and bank account | European Union (Netherlands) |
| Bird | Sending one-time codes by SMS for phone verification | Phone number, verification code | European Union (Netherlands) |
| "Sign in with Google" social sign-in | Email address, name, profile picture | United States (SCCs) | |
| Apple | "Sign in with Apple", and the maps shown in our iOS app | Email address, name; map requests and the area being viewed | United States (SCCs) |
Hosting and infrastructure
Our core infrastructure (application servers, databases, search index, message queue, cache, authentication and monitoring) runs on Scaleway dedicated servers in France. Our object storage is held by OVHcloud in its Luxembourg region. Both act as processors on our behalf under data processing agreements (Article 28 GDPR) and do not process your personal data for their own purposes.
Transactional and notification emails are sent through our own mail server (mail.next2u.email), which we operate within the European Union. We do not use a third-party email provider.