SERVICE PROVIDERS AND SUBPROCESSORS
Effective Date: September 5, 2026
Last Updated: September 5, 2026
Version: 1.0
This Service Providers and Subprocessors Disclosure explains which outside organizations may process personal information in connection with the AnnexusX Services.
It supplements the AnnexusX™ Privacy & Data Policy and Service Notices. If conflict or inconsistency exists between this Disclosure and the Terms & Conditions or Privacy & Data Policy, the order-of-precedence provisions in Article 1 of the Terms & Conditions apply.
The AnnexusX Services are provided by Purpura Quadrum, LLC, referred to in this disclosure as the ‘Company.’
This list reflects the services currently used by AnnexusX. A technology is not necessarily a subprocessor merely because it is used to develop or operate the Services.
ARTICLE 1 – GENERAL ROLES
1.1 Service Providers and Processors
A service provider or processor performs services selected by the Company and may process personal information on the Company's behalf.
The legal classification of a provider may vary depending on the applicable service, contractual relationship, type of information processed, jurisdiction, and applicable law.
The descriptions in this Disclosure explain the provider's general role and do not replace any applicable agreement, data-processing agreement, or legal classification required by law.
1.2 User-Connected Third-Party Services
Some Third-Party Services are connected directly by the User rather than selected by the Company to operate AnnexusX.
When a User authorizes such a connection, information may move between AnnexusX and the connected service as reasonably necessary to provide Product Features requested or enabled by the User.
A User-connected Third-Party Service is not necessarily acting as a Company service provider or subprocessor merely because the User chooses to connect it.
The User's relationship with a connected Third-Party Service remains subject to that provider's own terms, privacy practices, and other applicable requirements.
ARTICLE 2 – INFRASTRUCTURE AND OPERATIONAL PROVIDERS
| Provider | Service and Purpose | Information That May Be Processed | General Treatment |
| Cloudflare, Inc. | Website and application delivery, content delivery network services, domain and traffic routing, connection security, abuse prevention, access controls, and other infrastructure-protection functions. | IP addresses, request and connection information, browser or device information, network information, security events, technical identifiers, and other information transmitted through applicable Cloudflare services as reasonably necessary to deliver and protect the Services. | Service provider or processor. |
| Google LLC, through Google Cloud Platform | Cloud infrastructure used to host AnnexusX backend systems, including application programming interfaces, application databases, networking, storage, logging, and related operational infrastructure. | Account identifiers, User Content stored within AnnexusX, connected-service information processed through AnnexusX, encrypted authorization credentials, application records, operational logs, security information, and other information processed through Company backend systems. | Service provider or processor. |
| Google LLC, through Google Workspace | Business email and communications used by the Company to receive and respond to support inquiries, privacy requests, legal communications, accessibility inquiries, intellectual property reports, and other correspondence submitted to Company email addresses. | Names, email addresses, message contents, attachments voluntarily included by the sender, timestamps, correspondence history, and other information a person chooses to include in communications sent to the Company. | Service provider or processor. |
These providers may process information only to the extent reasonably necessary to provide, secure, maintain, support, or operate the applicable infrastructure services, subject to their agreements with the Company and applicable law.
Company-operated business systems may process information separately from Product Features within AnnexusX. For example, information voluntarily submitted to a Company support, privacy, or legal email address may be processed through the Company's business communication provider rather than through the AnnexusX application itself.
The amount and type of information processed by an infrastructure provider depends on the architecture and services used by the Company.
ARTICLE 3 – USER-CONNECTED GOOGLE SERVICES
AnnexusX allows Users to connect selected Google services through Google's authorization process.
These connections are initiated and authorized by the User.
The information AnnexusX may access depends on the permissions granted by the User and the Product Features the User chooses to enable.
Google operates these services independently under Google's own terms, privacy policies, security practices, and business practices.
AnnexusX accesses Google user data only for User-facing Product Features requested, enabled, or authorized by the User and in accordance with the Privacy & Data Policy.
The Company does not sell Google user data, use Google user data for advertising or retargeting, or use Google user data to train generalized artificial intelligence or machine learning models.
Users may manage or remove AnnexusX access through their Google Account connection settings.
Disconnecting AnnexusX does not delete emails, calendar events, contacts, or other information stored within the User's Google Account.
When a User permanently deletes an AnnexusX Account, the Company attempts to revoke the applicable Google authorization.
If Google does not confirm revocation, the Company may direct the User to remove AnnexusX manually through the connected-app settings within the User's Google Account.
Additional information concerning Google user data and Limited Use is provided in the Privacy & Data Policy.
ARTICLE 4 – SERVICES NOT CURRENTLY PROVIDED BY OUTSIDE PROCESSORS.
4.1 Support Assistant
The AnnexusX support assistant answers questions about the Services using designated support and help information.
The support assistant does not independently access, retrieve, read, or receive User Content stored within a User's Account and does not access information from connected Third-Party Services.
The Company does not currently send support-assistant conversations to an outside artificial-intelligence provider.
If an outside provider is introduced to process support-assistant communications, the applicable provider will be added to this Disclosure and the Privacy & Data Policy will be updated before or when that provider begins processing personal information.
4.2 Transactional Email
The Company does not currently use an outside transactional email provider to send automated application or support messages on behalf of AnnexusX.
This section does not refer to the Company's ordinary business email service used to receive and respond to communications sent to Company email addresses, which is identified in Article 2 where applicable.
If an outside transactional email provider is introduced, the applicable provider and its general processing role will be added to this Disclosure before or when it begins processing personal information.
4.3 Payment Processing
The Company does not currently use an outside payment processor in connection with the Services.
If payment processing is introduced, the applicable provider and its general processing role will be added to this Disclosure before or when that provider begins processing personal information.
4.4 Analytics and Monitoring
The Company does not currently use an external application analytics provider to analyze in-product User behavior and does not use advertising or behavioral analytics technologies within the Services.
Operational monitoring is performed through Company systems and the infrastructure providers identified in Article 2. Those providers may generate technical traffic, performance, availability, diagnostic, and security information as part of providing their services.
Campaign measurement is performed as described in the Privacy & Data Policy and does not currently rely on an outside advertising or analytics provider receiving Account-level conversion information.
ARTICLE 5 – OPEN SOURCE SOFTWARE
The Services incorporate open-source software packages and libraries.
Open-source software does not become a service provider or subprocessor merely because its code is incorporated into the Services, and open-source projects do not receive User Content solely because their software is used.
Applicable copyright notices, attribution information, and license terms are published through the Company's Open-Source Software Notices at:
annexusx.com/legal/open-source-software
ARTICLE 6 – FUTURE PROVIDERS
The Company may add, replace, or discontinue service providers as the Services develop.
A contemplated provider is not included in the active provider list until it begins providing the applicable service or otherwise processing personal information in connection with the Services.
When the Company introduces a material provider that processes personal information on its behalf, this Disclosure will be updated as reasonably appropriate.
Where applicable law or a contractual obligation requires advance notice of a material provider change, the Company will provide that notice through reasonable means.
ARTICLE 7 – PROVIDER POLICIES
Service providers and User-connected Third-Party Services may maintain their own privacy notices, security documentation, subprocessors, processing locations, and contractual terms.
Additional information may be available directly from the applicable providers, including:
The Company does not control the independent policies or practices of User-connected Third-Party Services.
ARTICLE 8 – Changes to This Disclosure
The Company may update this Disclosure to reflect changes in service providers, Third-Party Services, Company infrastructure, applicable law, or processing practices.
Because this Disclosure is informational rather than independently incorporated into the Terms & Conditions, changes may take effect when published unless advance notice is required by applicable law, the Terms & Conditions, or another applicable agreement.
The Effective Date and Last Updated date identify when the current version became effective and when it was most recently revised.
ARTICLE 9 – CONTACT INFORMATION
Questions concerning this Disclosure, the Company's service providers, or the processing of personal information may be submitted to:
The AnnexusX Services are provided by:
Purpura Quadrum, LLC
a Delaware limited liability company
Additional support and contact information may be made available through the Services or the Company's official website.
EFFECTIVE DATE
Effective Date: September 5, 2026
Last Updated: September 5, 2026
Version: 1.0