Skip to main content
MaaS

Sub-processors

Last updated 2026-09-01

MaaS engages the third parties below to deliver the service. This register is referenced by the sub-processing clause of our data processing agreement and is the authoritative list.

Application compute runs in the EU (fra1) and persisted personal data is stored in an EU region. Where a sub-processor is established outside the EEA, the transfer basis is stated on its entry.

Recent changes

We give at least 30 days' notice before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds.

Infrastructure and hosting

Vercel

Application hosting and serverless compute.

Data received
All data transiting the application; Account data; Lead PII; Request logs
Location
Compute pinned to EU (`fra1`); vendor HQ United States
Transfer basis
EU processing region; Standard Contractual Clauses (SCCs) for any US support access

Vercel Domains (registrar)

Domain registration on a customer's behalf when they buy a domain through the product.

Data received
Registrant contact details (name, email, telephone, postal address)
Location
Registrar United States; onward disclosure to the registry operating the domain ending
Transfer basis
Standard Contractual Clauses (SCCs); onward publication where ICANN or the registry's own rules require it

Neon

Primary application database (PostgreSQL).

Data received
All persisted personal data; Accounts; Leads and contacts; Conversions; Campaign and client data
Location
EU region (see docs/legal/risk-checklist.md for the verification); vendor HQ United States
Transfer basis
EU region provisioning; Standard Contractual Clauses (SCCs) for any US support access

Vercel Blob

Object storage for uploaded and generated media.

Data received
Uploaded and generated creative assets; Any personal data appearing in that media (e.g. people filmed in UGC video)
Location
EU region where available; vendor HQ United States
Transfer basis
Standard Contractual Clauses (SCCs)

Inngest

Durable background-job orchestration (retention purges, syncs, scheduled campaign work).

Data received
Job payloads referencing client and lead identifiers; Job execution logs
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

Advertising platforms

Meta

Ad campaign management and conversion matching.

Data received
SHA-256 hashed email and phone; Click IDs (fbclid, fbp); Campaign and conversion events
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

Google Merchant Center

Product feed management and order/conversion ingestion.

Data received
Product catalogue data; Order and conversion events
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

TikTok

Ad campaign management and conversion matching.

Data received
SHA-256 hashed email and phone; Click IDs (ttclid, ttp); Campaign and conversion events
Location
United States / Ireland
Transfer basis
Standard Contractual Clauses (SCCs)

Snapchat

Ad campaign management and conversion matching.

Data received
SHA-256 hashed email and phone; Click IDs (scClickId); Campaign and conversion events
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

LinkedIn

Ad campaign management, conversion matching, matched audiences, and Lead Gen form retrieval.

Data received
SHA-256 hashed email and phone; Click IDs; Lead Gen form responses (name, email, phone and any custom fields); Campaign and conversion events
Location
United States / Ireland
Transfer basis
Standard Contractual Clauses (SCCs)

Microsoft (Bing)

no end-customer personal data

Bing Webmaster Tools site verification and search performance data.

Data received
Website URLs; Aggregate search performance metrics
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

OpenAI (ChatGPT Ads)

Advertising platform connection and measurement.

Data received
Campaign and conversion events
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

CRM and contact sync

Mailchimp (Intuit)

Contact and audience synchronisation.

Data received
Contact PII (name, email, and synced fields)
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

HubSpot

Contact and CRM synchronisation.

Data received
Contact PII (name, email, phone, and synced fields)
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

Email, SMS and notifications

Resend

Transactional and marketing email delivery.

Data received
Recipient email address (plaintext); Message content; Delivery and engagement events
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

Twilio

SMS delivery.

Data received
Recipient phone number (plaintext); Message body; Delivery status
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

Slack (Salesforce)

Operator notifications and the Slack assistant integration, where an agency connects a workspace.

Data received
Notification and report content; Operator identity (name, email); Assistant message content
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

Expo, Apple APNs and Google FCM

Mobile push notification delivery.

Data received
Device push token; Notification content
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

AI and machine learning

Anthropic (Claude)

AI copy, campaign and creative generation; the in-app assistant.

Data received
Brand, website and campaign content; Operator-typed and dictated free text
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

OpenAI

Answer-engine probing, and speech-to-text transcription of operator-recorded voice notes and UGC video.

Data received
Brand and query terms; Recorded audio and video, including any voice or likeness captured in it
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

Google (Vertex AI / Gemini / Imagen)

AI text, image and video generation, and answer-engine probing.

Data received
Brand, website and campaign content; Prompts; Uploaded media supplied for creative generation
Location
Set by VERTEX_LOCATION; defaults to United States (`us-central1`) when unset
Transfer basis
Standard Contractual Clauses (SCCs). Set VERTEX_LOCATION to an EU region to keep processing in the EEA.

SiliconFlow

no end-customer personal data

Text embeddings and supplementary image inference.

Data received
Brand and campaign content submitted for embedding
Location
China / Singapore
Transfer basis
SCCs required. No EU adequacy decision covers China — see docs/legal/risk-checklist.md; restrict this vendor to non-personal brand content or replace it.

Perplexity

no end-customer personal data

Answer-engine optimisation probes (measuring brand visibility in AI answers).

Data received
Brand and query terms only
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

21st.dev (Magic)

no end-customer personal data

Brand logo lookup during website generation.

Data received
Brand name (which may be a personal name for a sole proprietorship)
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

Search and analytics

SerpApi

no end-customer personal data

Search-result retrieval for answer-engine and SEO probes.

Data received
Brand and query terms only
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

YouTube Data API (Google)

no end-customer personal data

Scanning public YouTube content for brand mentions.

Data received
Brand terms; Publicly available video metadata
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

Google Search Console

no end-customer personal data

Site verification and organic search performance reporting.

Data received
Website URLs; Aggregate search performance metrics
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)

Payments

Stripe

Subscription billing and, where enabled, Stripe Connect payouts to agencies.

Data received
Billing contact name and email; Payment method metadata (card brand, last four digits — full card data never reaches the platform); Invoice and transaction records
Location
United States / Ireland
Transfer basis
Standard Contractual Clauses (SCCs)

Identity and login

Vipps MobilePay

Norwegian OIDC login and recurring payment collection.

Data received
Operator identity (name, phone number, national identifier where released); Payment agreement and transaction records
Location
Norway (EEA)
Transfer basis
Processing within the EEA — no transfer mechanism required

E-commerce

Shopify

Connected-store order and conversion ingestion.

Data received
Order data; Associated customer PII (name, email, order value)
Location
Canada / United States
Transfer basis
Standard Contractual Clauses (SCCs)

Design tooling

Figma

Design and brand asset import.

Data received
Design files and any personal data appearing in them
Location
United States
Transfer basis
Standard Contractual Clauses (SCCs)