Sub-processors

ValueNova Limited engages a small number of third-party service providers ("Sub-processors") to deliver and support the platform. We are committed to transparency about who processes Customer Data on our behalf.

This page lists the Sub-processors we engage. Customers are notified at least thirty (30) days before any new Sub-processor is added or replaced. The full process and customer rights are set out in our Data Processing Agreement.

Current sub-processors

AI and your data

ValueNova uses third-party AI providers — Anthropic (Claude) and OpenAI — to power features such as value-model generation, document search, and voice capture. When you use these features, the relevant content (for example assessment inputs, uploaded documents, or meeting audio) is sent to these providers solely to return a result to you. Before assessment content is sent for AI generation we remove email addresses, telephone numbers and payment card numbers, and replace names and company names with tokens. That mapping is reversible, so the content remains personal data and we do not describe it as anonymised. Uploaded documents and voice audio are sent to our search and transcription sub-processors without redaction. These providers process your data under their commercial API terms, under which your data is not used to train their models.

Zero-data-retention is not currently available from these providers — it is reserved for enterprise agreements (significant usage volume and annual contract value). We requested it from Anthropic (declined) and from OpenAI (under review) and will update this page when it is in place. Under their standard commercial terms, however, your data is not used to train their models.

Administrators choose how AI runs for their organisation: Frontier (Claude/OpenAI — best quality), Local (a model you host yourself), or Off (AI features disabled entirely). The in-app AI Governance Center controls AI usage, capabilities and budgets.

What Local and Off actually change. They change where business-case AI runs. Two capabilities behave differently, and it is worth being precise about them:

• Document search runs on OpenAI embeddings and cannot run on a self-hosted model, because a search index is only comparable to vectors produced by the same model. Selecting Local therefore switches document search off rather than re-pointing it. An administrator may enable it for search alone; where they do, uploaded document text is sent to OpenAI.
• Voice transcription follows the selection: on Frontier it uses OpenAI Whisper, on Local it uses the speech endpoint you configure, and on Off it is disabled.

Under Anthropic's and OpenAI's standard commercial API terms, your content is not used to train their models.

Customer rights

When ValueNova adds or replaces a Sub-processor, ValueNova will:

1. notify the Customer at least thirty (30) days before the change takes effect;
2. allow the Customer thirty (30) days to object in writing on reasonable data protection grounds; and
3. if the Customer objects and the parties cannot resolve the matter, either party may terminate the affected Order Form on written notice with a pro-rata refund of any prepaid, unused fees.

All Sub-processors are bound by data protection obligations no less protective than ValueNova's own commitments under the customer's Data Processing Agreement.

Data residency

ValueNova hosts customer data in the European Union (Belgium). Application compute runs on Google Cloud Run and files are stored in Google Cloud Storage, both in the europe-west1 region; structured data is held in our managed database via Supabase in Stockholm, Sweden (North EU).

We do not currently offer per-customer choice of hosting region. AI inference (Anthropic, OpenAI) is processed in the US — see "AI and your data" above. Customers with specific data-residency requirements should contact Click to reveal email — additional regional hosting options for Enterprise customers are on our roadmap.

International transfers

Where personal data is transferred outside the United Kingdom or the European Economic Area to a jurisdiction not deemed adequate under UK GDPR or EU GDPR, ValueNova relies on:

• From the UK: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, in each case as issued by the Information Commissioner's Office.
• From the EEA: the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) Module 2 (controller-to-processor).

A Transfer Impact Assessment is available on request toClick to reveal email.

Note on website analytics

ValueNova's marketing website at valuenova.ai uses Google Analytics 4 for aggregate website analytics, configured with IP anonymisation enabled and no advertising features. Google Analytics is a website-only analytics tool and is not a Sub-processor of Customer Data under the Service. See our Cookies Policy for full details.

Contact

For sub-processor questions, objections, or DPA queries:

ValueNova Limited

71-75 Shelton Street

Covent Garden, London WC2H 9JQ

Click to reveal email