Sub-processors
Every third party that touches your data, what they do, and where they are.
Version 2.0 · Effective 5 September 2026
This page is the authoritative list. It is the same list incorporated into our Data Processing Agreement as Annex III, so the two cannot fall out of step.
Contents
A sub-processor is a third party that processes personal data on our behalf in order to deliver part of the Service. This is the complete list.
Providers marked conditional are engaged only if you use the corresponding feature. If you never connect a Microsoft mailbox, for example, Microsoft never receives anything from us.
This list is incorporated into our Data Processing Agreement as Annex III.
Infrastructure and hosting
| Provider | Legal entity and address | What it does | Data involved | Location | Transfer safeguard |
|---|---|---|---|---|---|
| Supabase | Supabase, Inc.970 Toa Payoh North, #07-04, Singapore 318992 | Primary database, authentication, file storage and serverless functions. The ManyPI project is provisioned in an EU region. | Account data, organisation data, lead and CRM records, synchronised mail, scraped output, usage and billing metadata | Singapore (company seat); data stored in the European Union | EEA — no transfer |
| Hetzner | Hetzner Online GmbHIndustriestr. 25, 91710 Gunzenhausen, Germany | Virtual servers running the background job worker, the email verification engine and the web data collection gateway. | Lead records, mail metadata and content in transit, scraping results, job queue payloads | Germany and Finland | EEA — no transfer |
| Netlify | Netlify, Inc.44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA | Application and website hosting, content delivery, TLS termination. | IP address and request metadata of visitors, data in transit | United States | EU-US Data Privacy Framework and, as a fallback, EU Standard Contractual Clauses |
Artificial intelligence
| Provider | Legal entity and address | What it does | Data involved | Location | Transfer safeguard |
|---|---|---|---|---|---|
| OpenAI | OpenAI, L.L.C.3180 18th Street, San Francisco, CA 94110, USA | All AI model inference: research agent reasoning, drafting assistance, structured extraction, and classification of inbound replies. OpenAI is contractually prohibited from training on data submitted through the API. | Prompts and instructions, lead records supplied as context, excerpts of inbound reply bodies, uploaded file contents, scraped page excerpts | United States | EU-US Data Privacy Framework and, as a fallback, EU Standard Contractual Clauses |
Web data collection
| Provider | Legal entity and address | What it does | Data involved | Location | Transfer safeguard |
|---|---|---|---|---|---|
| Bright Data | Bright Data Ltd.Habarzel 40, Tel Aviv 6971054, Israel | Web search, page retrieval and proxy infrastructure used to collect publicly accessible business information. | Target URLs and search queries; retrieved page content | Israel | Adequacy decision |
Payments
| Provider | Legal entity and address | What it does | Data involved | Location | Transfer safeguard |
|---|---|---|---|---|---|
| Polar | Polar Software Inc.3500 South DuPont Highway, Dover, DE 19901, USA | Merchant of record, checkout, subscription management, customer billing portal and metered overage billing. | Name, email address, billing address, country, tax status, transaction history | United States | EU-US Data Privacy Framework and, as a fallback, EU Standard Contractual Clauses |
| Lemon SqueezyLegacy subscribers only | Lemon Squeezy LLC228 Park Ave S, PMB 22435, New York, NY 10003, USA | Legacy merchant of record. Engaged only for subscribers who purchased before our migration to Polar and have not since re-subscribed. | Name, email address, billing address, transaction history | United States | EU-US Data Privacy Framework and, as a fallback, EU Standard Contractual Clauses |
| Provider | Legal entity and address | What it does | Data involved | Location | Transfer safeguard |
|---|---|---|---|---|---|
| Resend | Plus Five Five, Inc.2261 Market Street, Suite 5039, San Francisco, CA 94114, USA | Delivery of transactional, service and lifecycle email that ManyPI sends to you, and maintenance of the corresponding contact list. Resend does not deliver the outreach you send to your own contacts — that leaves your own mailbox. | Name, email address, subscription tier and status, credit balance, sign-up date, stated use case | United States | EU-US Data Privacy Framework and, as a fallback, EU Standard Contractual Clauses |
Sign-in and mailbox connectivity
| Provider | Legal entity and address | What it does | Data involved | Location | Transfer safeguard |
|---|---|---|---|---|---|
| GoogleSign-in with Google, or a connected Gmail mailbox | Google Ireland Limited / Google LLCGordon House, Barrow Street, Dublin 4, Ireland | Sign-in with Google. Separately, where you choose to connect a Gmail or Google Workspace mailbox, access to that mailbox over SMTP and IMAP using OAuth. | Name, email address, Google account identifier; mailbox content where connected | Ireland / United States | EU-US Data Privacy Framework and, as a fallback, EU Standard Contractual Clauses |
| MicrosoftOnly if you connect a Microsoft mailbox | Microsoft Ireland Operations Limited / Microsoft CorporationOne Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Where you choose to connect an Outlook or Microsoft 365 mailbox, access to that mailbox over SMTP and IMAP using OAuth. | Name, email address, Microsoft account identifier, mailbox content | Ireland / United States | EU-US Data Privacy Framework and, as a fallback, EU Standard Contractual Clauses |
Analytics and website
| Provider | Legal entity and address | What it does | Data involved | Location | Transfer safeguard |
|---|---|---|---|---|---|
| TWIPLAOnly with your analytics consent | TWIPLA GmbHBerlin, Germany | Website and in-app analytics. Loaded only after you accept the analytics category in our cookie banner, and never before. | Truncated IP address, pages viewed, referrer, device and browser characteristics | Germany | EEA — no transfer |
| Simple Analytics | Simple Analytics B.V.Amsterdam, Netherlands | Aggregate, cookieless traffic measurement for the marketing website. Sets no cookies and stores nothing on your device. | Page URL, referrer, country, aggregated counts — no cookies, no device identifiers | Netherlands | EEA — no transfer |
| Contentful | Contentful GmbHTucholskystraße 2, 10117 Berlin, Germany | Content management for the marketing website and blog. Holds no customer data. | Published marketing content only | Germany | EEA — no transfer |
Your account data, CRM records, lead records and synchronised mail are stored on servers located in the European Union.
- Primary database, authentication and file storage: European Union (Supabase, EU region).
- Background processing, email verification and the web research gateway: Germany and Finland (Hetzner Online GmbH).
Storage of your account data, CRM records, lead records and synchronised mail therefore involves no transfer outside the EEA.
Transfers to third countries occur only where a specific function requires a provider established outside the EEA — principally AI inference in the United States, web data collection in Israel, payment processing in the United States, and the delivery of our own service email. In every such case we rely on the EU Standard Contractual Clauses as a standing safeguard, in addition to any adequacy decision or framework certification that may also apply.
We do not rely on the EU-US Data Privacy Framework alone, because its validity is subject to pending litigation before the Court of Justice of the European Union. If it were invalidated, our Standard Contractual Clauses would continue to apply without any action by you or by us.
The Service lets you connect third-party systems of your own choosing, either directly or through the Model Context Protocol. Currently available presets include:
- HubSpot
- Intercom
- Notion
- Linear
- Asana
- Atlassian (Jira, Confluence)
- GitHub
- Sentry
- Vercel
- Cloudflare
- Stripe
- PayPal
- Square
- Canva
- Figma
- Zapier
- and any custom MCP server you configure
These are not ManyPI sub-processors. You choose them, you authorise the connection with your own credentials, and you decide what flows through it. In data protection terms you are the controller of that transfer, and you are responsible for having your own lawful basis and, where required, your own agreement with the provider.
We hold the credential you supply so the connection can operate. It is encrypted at the application layer and is never returned to the browser.
We list these because earlier versions of our documentation named them, and because an inaccurate list is as much a transparency failure as an incomplete one. Following a review of our systems in September 2026, the following are not engaged by ManyPI and have been removed:
- Crawlbase and Decodo — no integration exists. Web data collection is handled solely by Bright Data.
- Mailgun — no integration exists. Our own service email is delivered by Resend; your outreach leaves your own mailbox.
- Google Gemini and any other AI provider — OpenAI is our only AI provider. Google appears in the list above solely for sign-in and, if you connect one, Gmail mailbox access.
We also do not use any third-party error-tracking, session-recording, advertising or marketing-attribution service, and we do not embed reCAPTCHA or a comparable third-party CAPTCHA — ours is self-hosted.
We give at least thirty (30) days' notice before adding or replacing a sub-processor, except where a change is needed urgently to address a security risk, in which case we give notice as soon as possible afterwards.
To be notified, email privacy@manypi.com with the subject line "Subscribe: sub-processor changes" and the address you would like us to use. There is no charge, and we use the address for nothing else.
To object. If you are a customer and you object to a new sub-processor on reasonable data-protection grounds, write to legal@manypi.com within the notice period. If we cannot resolve your objection, you may terminate the affected part of your subscription without penalty and receive a pro-rata refund of prepaid fees for the unused remainder of your term. This right is set out in section 6 of the Data Processing Agreement.
Questions about any provider on this page: privacy@manypi.com