Join NOAL
Home/Sub-processor List
Legal Document

Sub-processor List

Version 2026-05-21 · Effective 5/21/2026

SUB-PROCESSOR LIST
NOAL AI, Inc.
Version 2026-05-21 · Effective May 21, 2026
Last Updated: May 21, 2026

To provide the high-performance AI underwriting and portfolio management services available at noal.ai (the “Services”), NOAL AI, Inc., a Delaware corporation with its principal place of business at 175 S. 3rd Street, Suite 200, Columbus, Ohio 43215 (“NOAL AI,” “we,” “us,” or “our”), engages third-party sub-processors who have access to certain data. Every sub-processor is vetted for security compliance and is bound by data processing agreements (DPAs).

THIS SUB-PROCESSOR LIST (THIS “LIST”) IS INCORPORATED INTO AND FORMS PART OF THE NOAL AI TERMS OF SERVICE AND DATA PRIVACY POLICY. IT CREATES RIGHTS, EXPECTATIONS, AND OBLIGATIONS SOLELY AS BETWEEN NOAL AI AND OUR INDIVIDUAL REGISTERED SUBSCRIBERS AND USERS, AND CONFERS NO RIGHTS OR REMEDIES UPON ANY THIRD PARTY. THE SUB-PROCESSORS IDENTIFIED IN THIS LIST MAY CHANGE FROM TIME TO TIME, AND THE LISTING OF ANY VENDOR DOES NOT CONSTITUTE A REPRESENTATION OR WARRANTY BY NOAL AI WITH RESPECT TO ANY SUCH VENDOR.

  1. Definitions

“Subscriber” means an individual or entity that has executed an Order Form or otherwise registered for, subscribed to, or used the Services in accordance with our Terms of Service.

“Subscriber Data” has the meaning given in the Terms of Service and includes any “personal data,” “personal information,” or similar term as defined under applicable data-protection law that NOAL AI processes on behalf of a Subscriber in the course of providing the Services.

“Data-Protection Laws” means all applicable data-protection and privacy laws and regulations, including (a) the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”); (b) the United Kingdom General Data Protection Regulation, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003; (c) the Swiss Federal Act on Data Protection; (d) the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), and analogous U.S. state privacy laws; and (e) any other applicable laws or regulations relating to the processing of personal data.

“Sub-Processor” means a third party that NOAL AI engages to process Subscriber Data on its behalf in connection with the provision of the Services. Sub-Processors do not include third parties to whom NOAL AI discloses information as a controller (such as professional advisors, tax authorities, or successors in a corporate transaction) or third parties to whom the Subscriber separately authorizes disclosure (such as integrations the Subscriber enables).

  1. Engagement and Use of Sub-Processors

2.1 Authorization. By accepting our Terms of Service and accessing or using the Services, each Subscriber provides a general written authorization to NOAL AI to engage and use the Sub-Processors identified in this List, and any successors to such Sub-Processors, to process Subscriber Data on the Subscriber’s behalf in connection with the provision of the Services. This Section 2.1 satisfies any requirement under Article 28(2) of the GDPR (and equivalent provisions of other Data-Protection Laws) for general written authorization.

2.2 Due Diligence; DPAs. Before engaging a Sub-Processor, NOAL AI performs a risk-based assessment of the Sub-Processor’s suitability. Each Sub-Processor is bound by a written data processing agreement (DPA) that imposes data-protection and confidentiality obligations no less protective than the obligations applicable to NOAL AI under our Terms of Service and our data-processing addenda, including obligations to (a) process Subscriber Data only on NOAL AI’s documented instructions and only to the extent necessary to provide the relevant service; (b) maintain appropriate technical and organizational measures; (c) ensure the confidentiality of personnel; (d) assist with data-subject rights, data-protection impact assessments, and security incidents; and (e) delete or return Subscriber Data at the end of the engagement.

2.3 Liability. NOAL AI remains responsible for the performance of its obligations under its agreement with each Subscriber when those obligations are performed by a Sub-Processor, subject in all events to the limitations of liability set forth in the Terms of Service (including the Unconditional Shield for Uncontrollable Events) and any applicable DPA. Nothing in this List enlarges or expands NOAL AI’s liability beyond the limits set forth in those documents, and any cap on liability set forth in those documents applies to claims arising from the acts or omissions of any Sub-Processor.

  1. Current List of Sub-Processors
    The table below lists the principal Sub-Processors currently engaged by NOAL AI to process Subscriber Data in connection with the Services. The processing locations are indicative; certain Sub-Processors may process data in additional locations consistent with their published documentation and our written instructions.

3.1 Note on AI Processing
When processing sensitive financial documents like T12s, rent rolls, and loan documents, NOAL AI utilizes zero-retention API endpoints where commercially available from the applicable Sub-Processor. Third-party AI models process the data in real time to extract insights but do not learn from or store your data on their servers. NOAL AI contractually prohibits its AI Sub-Processors from using Subscriber Data to train their generative AI models, unless expressly authorized in writing by the applicable Subscriber.

3.2 Sub-Processors of Sub-Processors
Each of the Sub-Processors listed above may engage its own sub-processors to assist in providing its services. NOAL AI does not maintain a list of such downstream sub-processors. Subscribers may consult the public documentation of each Sub-Processor for information regarding its own sub-processors.

  1. Notification of New or Replacement Sub-Processors

4.1 Notice. NOAL AI will notify Subscribers of any addition or replacement of a Sub-Processor that is intended to process Subscriber Data by providing prior notice through one or more of the following means: (a) updating this List on the Site; (b) email to the Subscriber's designated administrator; or (c) in-Service notification. NOAL AI will endeavor to provide such notice at least ten (10) business days before authorizing the new or replacement Sub-Processor to process Subscriber Data, unless a shorter period is permitted under applicable Data-Protection Laws or the circumstances described in Section 4.3 apply.

4.2 Objection. Where a Subscriber has executed a DPA that contemplates an objection right, the Subscriber may, within ten (10) business days following such notice, object in writing to the addition or replacement of a Sub-Processor on reasonable, documented data-protection grounds. NOAL AI and the Subscriber will work in good faith to resolve the objection. If NOAL AI is unable, in its reasonable judgment, to provide an alternative that addresses the Subscriber’s objection, the Subscriber’s sole and exclusive remedy is to terminate the affected Services for convenience upon written notice, with a pro-rata refund of any prepaid fees for the unused portion of the then-current subscription term following the effective date of termination. Continued use of the Services following the expiration of the objection period shall constitute the Subscriber’s acceptance of the new or replacement Sub-Processor.

4.3 Emergency Engagement. Notwithstanding the foregoing, NOAL AI may engage a new Sub-Processor without prior notice where reasonably necessary to (a) maintain the security, availability, or integrity of the Services; (b) respond to a security incident or other emergency; or (c) comply with applicable law. In such cases, NOAL AI will provide notice as soon as reasonably practicable thereafter.

  1. International Data Transfers
    NOAL AI and certain of its Sub-Processors are located in, and process Subscriber Data in, the United States and other countries. Where required by applicable Data-Protection Laws, NOAL AI relies on lawful transfer mechanisms, such as the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), the U.K. International Data Transfer Addendum, the EU-U.S. Data Privacy Framework (and the U.K. and Swiss extensions thereof), or other applicable transfer mechanisms, to govern transfers of Subscriber Data to the United States and other jurisdictions.

  2. Limited Reliance; No Endorsement; Force-Majeure Shield
    The listing of a Sub-Processor in this List is not an endorsement, certification, or warranty by NOAL AI of the Sub-Processor’s products, services, performance, security, or compliance, and Subscribers should not rely on the listing as a substitute for the Subscriber’s own due diligence. Information about each Sub-Processor’s privacy and security practices may be obtained from the Sub-Processor directly. NOAL AI disclaims all warranties with respect to Sub-Processors to the maximum extent permitted by applicable law, and NOAL AI's liability with respect to the acts or omissions of any Sub-Processor shall be subject to the limitations and caps set forth in the Terms of Service and any applicable DPA.

WITHOUT LIMITING THE FOREGOING, AND AS PROVIDED IN THE TERMS OF SERVICE AND DATA PRIVACY POLICY, NOAL AI SHALL NOT BE LIABLE FOR BREACHES, FAILURES, OR INCIDENTS OCCURRING AT THE SUB-PROCESSOR LEVEL (E.G., AWS, OPENAI, ANTHROPIC, GOOGLE, STRIPE), PROVIDED THAT NOAL AI HAS MAINTAINED COMMERCIALLY REASONABLE SECURITY STANDARDS IN ITS SELECTION AND OVERSIGHT OF SUCH SUB-PROCESSORS, AND ANY LIABILITY OF NOAL AI ARISING FROM OR RELATING TO A SUB-PROCESSOR IS SUBJECT TO THE DISCLAIMERS, EXCLUSIONS, AND LIMITATIONS SET FORTH IN OUR TERMS OF SERVICE AND DATA PRIVACY POLICY, INCLUDING ANY APPLICABLE FORCE MAJEURE OR UNCONTROLLABLE EVENTS PROVISIONS.

  1. Updates to This List
    NOAL AI may update this List from time to time to reflect changes in our Sub-Processors or our business. The most current version of this List will be posted on the Site, with the “Last Updated” date indicated at the top. Subscribers should review this List periodically. Continued use of the Services following any update constitutes acceptance of the updated List.

  2. Contact Us
    Questions about this List may be directed to:
    NOAL AI, Inc.
    Attn: Privacy Office
    175 S. 3rd Street, Suite 200
    Columbus, Ohio 43215
    Email: privacy@noal.ai

© 2026 NOAL AI, Inc. All rights reserved.

Back to home