/* VALDEX — Subprocessors */

const UPDATED_SP = "May 18, 2026";

function SubprocessorsPage() {
  return (
    <LegalShell
      title="Subprocessors"
      updated={UPDATED_SP}
      intro={
        <React.Fragment>
          <p>
            A <strong>subprocessor</strong> is a third party that processes personal data
            on our behalf. This page lists every subprocessor <strong>VALDEX LLC</strong>{" "}
            uses to run the business — what data they touch, where they are, what
            safeguards apply for international transfers, and which certifications they
            hold.
          </p>
          <p>
            The list is part of our <a href="/dpa">Data Processing Addendum</a>. When we
            add or replace a subprocessor that processes client personal data, we publish
            the change here and notify affected clients at least <strong>30 days</strong>{" "}
            in advance.
          </p>
        </React.Fragment>
      }
      sections={[
        { id: "list", h: "1. Current subprocessors", body: (
          <React.Fragment>
            <table className="legal-table">
              <thead>
                <tr>
                  <th>Subprocessor</th>
                  <th>Service provided</th>
                  <th>Personal data processed</th>
                  <th>Region of processing</th>
                  <th>Safeguards for transfers from EU/UK</th>
                  <th>Security certifications</th>
                </tr>
              </thead>
              <tbody>
                <tr>
                  <td><strong>Stripe, Inc.</strong><br /><a href="https://stripe.com/privacy">Privacy</a></td>
                  <td>Invoicing and card processing</td>
                  <td>Client billing contact, invoice line items, payment-method token (Stripe holds the card number, not Valdex)</td>
                  <td>United States; EU sub-infrastructure for EU customers</td>
                  <td>EU–U.S. Data Privacy Framework certified; Standard Contractual Clauses</td>
                  <td>PCI DSS Level 1; SOC 1, SOC 2 Type II; ISO 27001</td>
                </tr>
                <tr>
                  <td><strong>Google LLC</strong> (Google Workspace)<br /><a href="https://workspace.google.com/terms/dpa_terms.html">Workspace DPA</a></td>
                  <td>Business email, Drive (documents), Calendar, Meet, admin logs</td>
                  <td>Email contents, document contents, calendar events, contact records, attachments</td>
                  <td>United States; configurable EU data region</td>
                  <td>EU–U.S. Data Privacy Framework certified; Standard Contractual Clauses; UK IDTA</td>
                  <td>ISO 27001, 27017, 27018; SOC 1, SOC 2, SOC 3</td>
                </tr>
                <tr>
                  <td><strong>1Password (AgileBits Inc.)</strong><br /><a href="https://1password.com/legal/privacy">Privacy</a></td>
                  <td>Credential vault for engagement credentials</td>
                  <td>Account holder name, account holder email; credentials are end-to-end encrypted and unreadable by 1Password</td>
                  <td>Canada</td>
                  <td>Adequacy decision: Canada is an adequate country under the GDPR; transfers do not require SCCs</td>
                  <td>SOC 2 Type II; ISO 27001, 27017, 27018</td>
                </tr>
                <tr>
                  <td><strong>Plausible Analytics</strong> (Plausible Insights OÜ)<br /><a href="https://plausible.io/dpa">DPA</a></td>
                  <td>Cookieless web analytics for valdexai.com</td>
                  <td>Page URL, referrer, country, device class; no cookies; no cross-site tracking; no individual identifiers</td>
                  <td>European Union (Germany; Hetzner)</td>
                  <td>Data does not leave the EU. No transfer mechanism needed.</td>
                  <td>GDPR-compliant by design (no personal data persisted)</td>
                </tr>
                <tr>
                  <td><strong>Cloudflare, Inc.</strong><br /><a href="https://www.cloudflare.com/privacypolicy/">Privacy</a></td>
                  <td>DNS, edge caching, DDoS protection, bot management for valdexai.com</td>
                  <td>IP address, request metadata; transient bot-management cookie (<code>__cf_bm</code>)</td>
                  <td>Global edge; closest available data center to the visitor</td>
                  <td>EU–U.S. Data Privacy Framework certified; Standard Contractual Clauses</td>
                  <td>ISO 27001, 27018; SOC 2 Type II; PCI DSS Level 1; FedRAMP Moderate</td>
                </tr>
                <tr>
                  <td><strong>unpkg / Cloudflare</strong><br /><a href="https://www.cloudflare.com/privacypolicy/">Privacy</a></td>
                  <td>Public CDN serving React, ReactDOM, and Babel runtime to visitors' browsers</td>
                  <td>IP address, user-agent, requested resource</td>
                  <td>Global Cloudflare edge</td>
                  <td>EU–U.S. Data Privacy Framework certified; Standard Contractual Clauses</td>
                  <td>Same as Cloudflare above</td>
                </tr>
                <tr>
                  <td><strong>Bunny.net</strong> (BunnyWay d.o.o.)<br /><a href="https://bunny.net/privacy">Privacy</a></td>
                  <td>Web font CDN (Bunny Fonts) — privacy-respecting Google Fonts alternative</td>
                  <td>IP address (used to route to nearest edge; not persisted by Bunny Fonts)</td>
                  <td>European Union (Slovenia)</td>
                  <td>Data does not leave the EU for EU visitors. SCCs for non-EU transfers.</td>
                  <td>ISO 27001 in progress (as of 2026)</td>
                </tr>
              </tbody>
            </table>
          </React.Fragment>
        )},
        { id: "advisors", h: "2. Professional advisors", body: (
          <React.Fragment>
            <p>
              The following are not subprocessors in the GDPR sense (they are independent
              controllers of any data we share with them) but we list them for
              transparency:
            </p>
            <table className="legal-table">
              <thead>
                <tr>
                  <th>Advisor</th>
                  <th>Role</th>
                  <th>Data typically shared</th>
                  <th>Region</th>
                </tr>
              </thead>
              <tbody>
                <tr>
                  <td>External CPA</td>
                  <td>Bookkeeping, tax filing</td>
                  <td>Invoices, financial records</td>
                  <td>United States</td>
                </tr>
                <tr>
                  <td>External counsel</td>
                  <td>Legal review, contract negotiation</td>
                  <td>Whatever is necessary for the specific matter</td>
                  <td>United States</td>
                </tr>
                <tr>
                  <td>Liability insurer</td>
                  <td>Professional indemnity / cyber-liability cover</td>
                  <td>Aggregate engagement and risk information; no client PI absent a claim</td>
                  <td>United States</td>
                </tr>
              </tbody>
            </table>
          </React.Fragment>
        )},
        { id: "clientside", h: "3. Client-authorized platforms", body: (
          <p>
            During an engagement we access platforms <strong>you</strong> have authorized
            us to use on your behalf (e.g. Google Analytics, your CRM, your CMS, ad
            accounts on Meta / Google / LinkedIn / X / TikTok, Slack workspaces). These
            are <strong>your</strong> systems and your relationships, not our
            subprocessors. The data inside them is processed under your existing
            agreements with those providers. We follow your access policy and the
            least-privilege principle described in our <a href="/trust">trust &amp; security</a>{" "}
            page.
          </p>
        )},
        { id: "changes", h: "4. Change-notification commitment", body: (
          <React.Fragment>
            <p>
              When we add a new subprocessor that will process client personal data:
            </p>
            <ul>
              <li>We update this page first, with the new entry and an effective date.</li>
              <li>Affected clients are notified by email at least <strong>30 days</strong> before the new subprocessor begins processing — sooner where required by the client's specific DPA.</li>
              <li>Clients may object on reasonable grounds. If we cannot accommodate the objection (e.g. the subprocessor is foundational), we will work in good faith on a path forward — including, in the limit, allowing the client to terminate the affected engagement without penalty for the remaining notice period.</li>
            </ul>
            <p>
              You can subscribe to subprocessor-change notifications by emailing{" "}
              <a href="mailto:privacy@valdexai.com?subject=Subprocessor%20notifications">privacy@valdexai.com</a>{" "}
              with the subject "Subprocessor notifications" — we will add you to the
              announcement list. The list is used only for this purpose.
            </p>
          </React.Fragment>
        )},
        { id: "removed", h: "5. Recently removed subprocessors", body: (
          <p style={{ fontStyle: "italic", color: "var(--ink-dim)" }}>
            None at the time of this revision. We will list providers we have stopped
            using in this section, with the date of removal, so the list has a history.
          </p>
        )},
        { id: "contact", h: "6. Contact", body: (
          <React.Fragment>
            <p>Questions about a specific subprocessor, or a request for evidence of safeguards:</p>
            <p>
              <strong>VALDEX LLC</strong><br />
              Attn: Privacy<br />
              1309 Coffeen Ave, Ste 1200<br />
              Sheridan, WY 82801, United States<br />
              <a href="mailto:privacy@valdexai.com">privacy@valdexai.com</a>
            </p>
          </React.Fragment>
        )},
      ]}
    />
  );
}

ReactDOM.createRoot(document.getElementById("root")).render(<SubprocessorsPage />);