Subprocessors
Last updated 11 August 2026
Nolira uses a small number of third-party service providers to deliver the platform. This page lists what each category processes and why.
Draft pending legal review. This document is a working draft written to describe how Nolira intends to operate. It has not yet been reviewed by a qualified lawyer in Malaysia and should not be relied on as a binding agreement until it has.
1. Current state of this list
Nolira is pre-launch and running paid pilots. Several providers are still being selected with pilot customers, particularly for payments and messaging, which vary by market. Rather than publish placeholder vendor names we may not use, this page lists the processing categories and what each handles. The named vendor list for your organisation is provided on request and in your data processing agreement.
2. Processing categories
| Purpose | Data processed | Note |
|---|---|---|
| Cloud hosting and database | All application and business data | Region selected close to Malaysia and Singapore |
| Object storage | Client photographs, exports and documents | Signed, short-lived access only |
| Transactional email | Recipient name, email address, message content | Confirmations, receipts and staff notifications |
| Push notifications | Device token, notification title and body | Sensitive detail is withheld from notification content |
| SMS and WhatsApp delivery | Recipient phone number and message content | Selected per market with the pilot customer |
| Payment processing | Payment amount, reference and status | Card data is handled by the provider, never stored by Nolira |
| Error and performance monitoring | Diagnostic data, pseudonymous identifiers | Configured to exclude personal data and free-text notes |
| Product analytics | Pseudonymous usage events | No client names, notes or contact details |
3. How we select a subprocessor
- A written contract requiring processing only on our instruction.
- Security and privacy practices reviewed before onboarding.
- Data minimisation, so each provider receives only what it needs.
- A hosting region consistent with our commitments to customers.
4. Changes
We will give customers at least 30 days' notice before adding or replacing a subprocessor that processes personal data. If you have a reasonable objection on data protection grounds, tell us within that period and we will work with you on an alternative or, if none exists, allow you to terminate without penalty for the affected service.
5. Requesting the named list
Customers and prospective customers can request the current named subprocessor list, including hosting regions, by writing to hello@nolira.my. We will also complete your security or vendor assessment questionnaire.