Sub-processors
Last updated: May 2026. Third-party services that process customer data on MadMantra's behalf. Required disclosure under GDPR Article 28 and most enterprise Data Processing Agreements.
We use a small set of vetted service providers. Each one is bound by its own data-protection terms, and we sign Data Processing Agreements with every sub-processor that handles personal data. We notify customers in advance of material changes to this list per the terms of our DPA.
| Service | Purpose | Data processed | Region |
|---|---|---|---|
| Anthropic ↗ | AI model inference for chat, agents, and content generation | Chat messages, prompts, agent context (company info, tasks, documents) | United States |
| OpenAI ↗ | AI model inference for selected tasks (audio transcription via Whisper) | Voice notes uploaded via WhatsApp | United States |
| Google (Gemini / Veo) ↗ | AI video generation for ad creatives | Ad-creative prompts and generated outputs | United States |
| Stripe ↗ | Payment processing, subscriptions, and Connect payouts | Customer billing email, payment method (handled by Stripe — we never see card numbers), subscription state | United States |
| Resend ↗ | Transactional + commercial email sending and inbound email parsing | Recipient email addresses, subject lines, message bodies, delivery events | United States |
| Neon ↗ | Managed Postgres for the platform database and per-customer databases | All persistent customer data | United States (us-east) — EU region available on request |
| Render ↗ | Application hosting for the platform API, worker, and per-customer deployed services | Application code, environment variables, runtime logs | United States |
| Cloudflare ↗ | CDN, edge proxying, DNS, DDoS protection | Request metadata (IP address, user agent, path) and cached page content | Global edge network |
| Cloudflare R2 ↗ | Object storage for uploaded media (WhatsApp voice notes, images, attachments) | User-uploaded files | United States / Global |
| Meta ↗ | WhatsApp Cloud API messaging; Meta Ads delivery on the platform-managed ad account | WhatsApp message content (only for users who connect WhatsApp); ad creative assets and budgets | United States |
| GitHub ↗ | Source control for each customer’s deployed business app (one repo per company) | Generated application source code, commit history | United States |
| Inngest ↗ | Background job orchestration (nightly agent cycles, scheduled tasks) | Job payloads (company IDs, task identifiers, execution metadata) | United States |
| Vercel ↗ | Frontend hosting and edge functions for the dashboard | Request metadata, analytics page views | Global edge network |
Customer-deployed apps
Each customer's business app is deployed to its own dedicated Render service with its own dedicated Neon Postgres database. That deployment is the customer's own infrastructure footprint — they own the code, can export it, and can move providers if they choose. The sub-processors above process the customer's data only in the context of running these services.
Questions
For DPA requests, sub-processor inquiries, or compliance questions, email hello@madmantra.com.