Draft — pending legal review. This page is not a legal document yet. The operator's legal name ([OPERATOR LEGAL NAME]), postal address ([OPERATOR POSTAL ADDRESS]) and company number ([OPERATOR COMPANY NUMBER]) are placeholders to be filled in before launch.
Sub-processors
Mailprompt uses a small set of providers to run the service. This page lists them, what they receive and where they process it. It is the annex to the data processing agreement.
Current sub-processors
The list below reflects the providers the code and deployment actually use. Where a vendor has not been selected, the entry is a placeholder rather than an invented company.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services, Inc. (Amazon SES) | Email delivery, bounce and complaint feedback | Sender and recipient addresses, message content, delivery events, message tags | United States, in the region the operator configures |
| Stripe, Inc. | Subscription billing, invoices and the customer portal | Billing name and email, payment-method token, invoice and tax identifiers | United States and Ireland |
| Cloudflare, Inc. | DNS, CDN, tunnel and edge request handling | Request metadata, IP address, DNS records configured for customer domains | Global edge network |
| [AI INFERENCE PROVIDER] | Text generation for drafts, suggestions and explanations | Brand, catalog, flow and campaign context. Subscriber email addresses are not sent to the text model. | [AI PROVIDER REGION] — to be confirmed with the vendor |
| [IMAGE GENERATION PROVIDER] | Image generation for email artwork | Image prompts and any reference images the account supplies | [IMAGE PROVIDER REGION] — to be confirmed with the vendor |
| [HOSTING PROVIDER] | Application, database and queue hosting | Account data, subscriber data, events, drafts and logs | [HOSTING REGION] — to be confirmed with the vendor |
What is not sent to a sub-processor
Subscriber email addresses are not sent to the text model. The assistant receives brand, product and campaign context so it can write a draft; recipient selection happens in the account database, not in the model. Click and open events are stored in the account database and used for the account's own reporting.
International transfers
Some providers process data outside the European Economic Area. Where that happens, the transfer relies on the provider's standard contractual clauses or an equivalent mechanism, and the DPA records which mechanism applies. The final list and the mechanism for each provider will be confirmed before paying customers are onboarded.
Changes
A new sub-processor that touches personal data will be announced to account owners before it starts processing, with a reasonable objection window. Emergency replacements for a failed provider may happen sooner; the list is updated at the same time and the change is described in the notice.
Related documents
The data processing agreement sets out the terms, the privacy notice explains the processing, and the cookie notice lists the cookies the service sets.