Mailistix Data Processing Agreement

Version: 1.4 · Valid from: 3 November 2026

This Data Processing Agreement ("DPA") is made between the Business Customer that has accepted the Mailistix Terms of Service (the "Terms") ("Customer", "you", "your") and Mailistix UG (haftungsbeschränkt), Kolonnenstr. 8, 10827 Berlin, Germany, registered in the commercial register of the Amtsgericht Charlottenburg (Berlin) under HRB 291268 B ("Mailistix", "we", "us", "our"). It sets out how we process personal data on your behalf when you use the Mailistix Service, as required by Article 28 of the GDPR, the UK GDPR and the Swiss FADP. The current version is published at https://mailistix.com/legal/dpa.

In brief (for orientation only; the sections below govern):

• Your mail stays with your mailbox providers (for example Google or Microsoft) and, as a local copy, on your devices. We have no access to that copy. This DPA covers only what passes through or is kept in our Cloud Services.
• Mail content reaches our Cloud Services only when one of your users uses an AI Feature, including the learning from edits after sending a changed AI draft. We pass it to our AI providers, return the result and do not store the content.
• On your behalf, our servers keep only a few technical records: push-notification records (7 days), mailbox watch registrations (while a mailbox is connected) and support uploads (30 days). Support emails and contact form messages stay in our mailbox for 2 years after the last message.
• You are the controller and we are your processor. For your users' Accounts, billing, security and optional telemetry, we are an independent controller under our Privacy Policy.
• Our subprocessors are listed in Annex 3. We give 14 days' notice before adding one, and you may object.

1. Conclusion, scope and precedence

1.1 Conclusion. This DPA forms part of the Terms. It applies automatically, without a signature, to every Business Customer that accepts the Terms, from the time of acceptance or from the effective date above, whichever is later. It is concluded in electronic form, which meets the written-form requirement of Article 28(9) GDPR. When an Authorized User accepts the Terms in the Software, we record the version of the Terms and of this DPA that was accepted, the time of acceptance on our server, whether it was given at sign-up or in a later prompt, and the version of the Software (Section 1.8 of the Terms); Settings › Legal shows since when the current version of this DPA applies. You can retrieve and save this DPA at any time at the address above and in Settings › Legal, and we keep earlier versions available. If you need a copy signed by us for your records, write to legal@mailistix.com and we will send you this DPA signed by us. A signed copy does not change its content.

1.2 Authorized Users. You use the Service through the natural persons who hold Accounts and use them for your business purposes, such as your employees and contractors ("Authorized Users"). Each Account is for one natural person (see the EULA). The person who accepts the Terms for you confirms that they are authorized to bind you. You are responsible for your Authorized Users' compliance with this DPA. The Service has no organization accounts: please tell us by email to legal@mailistix.com which Accounts belong to you and whom we should notify under this DPA (Section 17.6).

1.3 Scope. This DPA applies to the processing of Customer Personal Data by us on your behalf in the Cloud Services. It does not apply to:

(a) processing by the Software on your devices (Section 3); or

(b) processing for which we are an independent controller (Section 2.4).

1.4 Precedence. If this DPA conflicts with Part I of the Terms, the EULA or the Acceptable Use Policy, this DPA prevails as far as the processing of Customer Personal Data is concerned. The Regional Terms keep the priority that the Terms give them. Where the SCCs apply (Section 12), they prevail over this DPA and the Terms. Nothing in this DPA or the Terms limits the rights that data subjects or supervisory authorities have under the SCCs or Data Protection Laws.

1.5 Terms used. Capitalized terms not defined in this DPA have the meaning given in the Terms.

2. Definitions and roles

2.1 Definitions. In this DPA:

• "Data Protection Laws" means all laws on the protection of personal data that apply to the processing under this DPA, in particular the GDPR, the German Federal Data Protection Act (BDSG), the UK GDPR, the FADP and, where applicable, the U.S. state laws referred to in Section 16.
• "GDPR" means Regulation (EU) 2016/679.
• "UK GDPR" means the GDPR as it forms part of the law of the United Kingdom, read together with the Data Protection Act 2018, as amended, including by the Data (Use and Access) Act 2025.
• "FADP" means the Swiss Federal Act on Data Protection of 25 September 2020 and its ordinances.
• "Data Act" means Regulation (EU) 2023/2854 (the EU Data Act).
• "Customer Personal Data" means personal data contained in Customer Content that we process on your behalf in the Cloud Services to provide the Service, as described in Annex 1.
• "Subprocessor" means a processor engaged by us that processes Customer Personal Data.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed by us or our Subprocessors.
• "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, version B1.0, in force since 21 March 2022, as revised by the Information Commissioner under Section 18 of its Mandatory Clauses.
• "Restricted Transfer" means a transfer of Customer Personal Data to a country outside the EEA, the United Kingdom or Switzerland (as applicable) that needs appropriate safeguards under Data Protection Laws because no adequacy decision or regulation covers it.
• "controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meaning given in the GDPR. Under other Data Protection Laws, they include the equivalent terms (for example "business" and "service provider").

2.2 You as controller. For Customer Personal Data, you are the controller and we are your processor.

2.3 You as processor. If you process Customer Personal Data on behalf of another controller (for example a client of yours), you are a processor and we are your subprocessor. In that case:

(a) you confirm that the other controller has authorized the processing under this DPA, including the engagement of us and of our Subprocessors;

(b) you are the other controller's only point of contact with us; you pass on its instructions and requests, and we accept instructions only from you;

(c) you pass on our notices and information under this DPA to the other controller where needed; and

(d) the other controller exercises its information and audit rights through you, under Section 11; and

(e) you make sure that this DPA imposes on us the data protection obligations that your contract with the other controller requires for a subprocessor (Article 28(4) GDPR).

2.4 Our own controller processing. We process some personal data of your Authorized Users as an independent controller, under our Privacy Policy and not under this DPA, namely for:

(a) the Account, sign-in and authentication;

(b) Plans, Credits and billing; payments are handled by Polar Software, Inc. as merchant of record, which acts as an independent controller and receives the Authorized User's email address and Mailistix user ID (and, at checkout, the IP address);

(c) usage metadata of AI requests (feature, model, token counts, Credits, time, success or error, without any content) for billing, cost control and security;

(d) security, rate limiting, and the prevention and investigation of abuse;

(e) optional usage analytics and crash reports, only with the Authorized User's opt-in;

(f) consent records, the record of the acceptance of the Terms and this DPA (Section 1.1), the Region Setting, app updates, and our communication with Authorized Users, including support (except Customer Personal Data contained in support uploads and support messages, which we process under this DPA); and

(g) compliance with our legal obligations.

Where Data Protection Laws require you to inform your Authorized Users about this processing, you may refer them to the Privacy Policy.

3. Data on your devices

3.1 Local processing under your control. The Software stores Mailbox Data and other Customer Content on the devices on which your Authorized Users install it, in an encrypted database whose key is protected by the operating system's credential store. The Software synchronizes mail directly between the device and the Connected Mailbox. This processing takes place on your devices under the sole control of you and your Authorized Users. We have no access to the local database, its key, the mailbox tokens stored on the device or the mail it contains. We do not receive copies of them and do not process them on your behalf. Providing the Software does not make us your processor for that data.

3.2 Mailbox providers. Your mailbox providers (Google, Microsoft or the provider of a mailbox connected through IMAP) provide your Connected Mailboxes under your own contracts with them. They are not our Subprocessors. This also applies when Google or Microsoft authorize mailbox access through OAuth and when Microsoft sends change notifications about your mailbox to our server function.

3.3 When data leaves the device. Customer Personal Data reaches the Cloud Services only in the situations listed in Annex 1, each started by an Authorized User or by a mailbox that an Authorized User connected: use of an AI Feature (including the learning from edits after an Authorized User sends a changed AI draft), connecting a mailbox, push notifications about new mail, one-click newsletter unsubscribe, and support uploads.

3.4 Your responsibilities on the device side. You are responsible for securing the devices and operating-system accounts on which the Software runs, for backups, and for deleting local data when an Authorized User leaves or a device is retired. Annex 2, Part B and the EULA describe the Software's functions for this.

4. Instructions

4.1 Processing only on instructions. We process Customer Personal Data only on your documented instructions, including with regard to transfers to third countries, unless EU or Member State law (or, for UK or Swiss data, UK or Swiss law) to which we are subject requires otherwise. In that case, we inform you of that legal requirement before processing, unless that law prohibits this on important grounds of public interest.

4.2 Your instructions. At the time this DPA is concluded, your complete documented instructions are:

(a) the Terms and this DPA, including its Annexes;

(b) the use and configuration of the Service by you and your Authorized Users, in particular enabling the AI Features in the AI consent dialog, starting an AI Feature, sending a changed AI draft while the AI Features are enabled (learning from edits), the Region Setting, connecting or removing a mailbox, starting a one-click unsubscribe and sending a support upload; and

(c) any further written instruction agreed between the parties.

4.3 Region Setting. Each Authorized User tells the Software where they are based (the Region Setting under the Terms). This setting is your instruction on where AI requests are processed:

(a) "In Europe" (the EU, the EEA, the United Kingdom or Switzerland), or no answer: all AI processing takes place in the EU (Annex 3);

(b) "Outside Europe": some Gemini models run on Google's global endpoint, which may process data in any country where Google operates; all other AI processing stays in the EU.

You are responsible for making sure that your Authorized Users answer in line with your requirements. An Authorized User can change the Region Setting in Settings › Privacy & AI. A change applies to later requests only.

4.4 Further instructions. Further instructions must be given in writing (email is sufficient) and must be consistent with the Terms and the Service as offered. If an instruction would require us to change the Service, or to process Customer Personal Data in a way the Service does not support, we may decline it. You may then terminate the Terms for the affected Accounts.

4.5 Unlawful instructions. We inform you without undue delay if, in our opinion, an instruction infringes Data Protection Laws. We may suspend carrying out that instruction until you confirm or change it.

4.6 No use for our own purposes. We do not process Customer Personal Data for our own purposes. In particular, we do not sell it, do not use it for advertising or profiling, and do not use it to train, develop or improve artificial intelligence or machine-learning models, whether ours or anyone else's. Our AI Subprocessors are contractually barred from using it to train their models. The personalization of drafts described in Annex 1 works by adding examples to the request; no model is trained or changed.

5. Confidentiality

5.1 We grant access to Customer Personal Data only to persons who need it to provide the Service. Each of them has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, which continues after their engagement ends.

5.2 We do not store the content of AI requests or of AI Output (Annex 1). Our personnel do not read Customer Personal Data, except:

(a) where you or an Authorized User ask us to look at specific content, for example in a support case;

(b) where it is necessary to investigate a security incident or abuse; or

(c) where the law requires it.

Each such access is limited to what its purpose requires.

5.3 Professional secrecy. If you are bound by professional secrecy, in particular under Section 203(1) to (3) of the German Criminal Code (StGB), Section 43e of the Federal Lawyers' Act (BRAO), Section 62a of the Tax Advisers Act (StBerG) or comparable rules, we act as a person involved in your professional activity (mitwirkende Person, Section 203(3) sentence 2 StGB) as far as we process secrets entrusted to you under this DPA. For that case:

(a) we undertake to keep such secrets confidential, and we are aware that an unauthorized disclosure is punishable under Section 203(4) sentence 1 StGB;

(b) we obtain knowledge of such secrets only to the extent that providing the Service requires (Section 5.2);

(c) we bind the persons who work for us to secrecy in text form and inform them of the criminal consequences of a breach; and

(d) we engage Subprocessors only under Section 7. They are bound to confidentiality by their data processing terms (Section 7.2), but have not given us an undertaking specific to Section 203 StGB, and some of them are established, or have their parent company, outside the EU (Annex 3).

This Section 5.3 is the confidentiality undertaking referred to in Section 9.6 of the Terms; on request, we send you a copy signed by us. Whether your professional rules permit you to use the AI Features or the Cloud Services with secrets entrusted to you, in particular in view of point (d) (for example Section 43e(3) and (4) BRAO), is for you to decide (Section 14.3(d) and Section 9.6 of the Terms).

6. Security

6.1 We implement and maintain the technical and organizational measures described in Annex 2. They ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks for the rights and freedoms of natural persons (Article 32 GDPR).

6.2 The measures are subject to technical progress. We may change them, provided that the overall level of protection is not reduced. We document material changes and update Annex 2 accordingly.

6.3 You are responsible for assessing whether the measures meet your requirements, and for the measures within your own control (Section 3.4 and Annex 2, Part B).

7. Subprocessors

7.1 General authorization. You give us general written authorization to engage Subprocessors. The Subprocessors listed in Annex 3 and on https://mailistix.com/legal/subprocessors when this DPA is concluded are authorized.

7.2 Requirements. Before a Subprocessor processes Customer Personal Data, we:

(a) check that it provides sufficient guarantees to implement appropriate technical and organizational measures;

(b) conclude a written contract with it that imposes data protection obligations offering at least the same level of protection as this DPA, as required by Article 28(4) GDPR; and

(c) ensure a lawful transfer mechanism wherever a Restricted Transfer takes place (Section 12).

We remain fully liable to you for the performance of each Subprocessor's obligations.

7.3 Notice of changes. We inform you of any intended addition or replacement of a Subprocessor at least 14 days before it starts processing Customer Personal Data. We do so by updating the Subprocessors page and by a notice to the Account email addresses of your Authorized Users or in the Software, and by email to your data protection contact if you have given us one (Section 17.6). The notice names the Subprocessor, its service, the processing location and the transfer mechanism.

7.4 Objection. You may object to a new Subprocessor by writing to legal@mailistix.com within 14 days after the notice, on reasonable grounds relating to data protection. We will discuss the objection with you in good faith and may propose a solution, for example not using the new Subprocessor for your Accounts or switching off the affected feature for them. If we cannot resolve the objection, you may terminate the Terms for the affected Accounts by written notice, effective no later than the date on which the new Subprocessor would start processing Customer Personal Data for you. We will then refund the fees you prepaid for the period after termination, pro rata, through Polar as our merchant of record. Your other rights under Data Protection Laws remain unaffected.

7.5 Urgent replacement. If we must replace a Subprocessor at short notice for reasons beyond our reasonable control (for example a security incident at the Subprocessor, or the Subprocessor ending its service), and the replacement is necessary to keep the Service secure or available, we may engage the replacement before the 14-day period ends. We then inform you without undue delay, and Section 7.4 applies from that notice. Where the SCCs apply, their Clause 9 prevails.

7.6 Copies. On request, we give you a copy of the data protection terms we agreed with a Subprocessor, or a link to its standard terms. We may remove commercial information and clauses unrelated to data protection.

7.7 Not Subprocessors. The following are not our Subprocessors: your mailbox providers (Section 3.2); Polar as merchant of record (Section 2.4); the senders of newsletters to which an unsubscribe request is sent at an Authorized User's request; and the providers of your operating systems.

8. Assistance

8.1 Data subject requests. Most personal data about your Authorized Users and their correspondents is held by your mailbox provider and on your devices, not by us (Section 3). Taking this into account, we assist you, by appropriate technical and organizational measures, in responding to requests from data subjects who exercise their rights under Chapter III GDPR and the equivalent rights under other Data Protection Laws:

(a) The Software lets each Authorized User export the data we hold for their Account, including push-notification records and support upload records (Settings › General › Account › "Export data"); remove a Connected Mailbox; withdraw AI consent and change the Region Setting (Settings › Privacy & AI); and delete the Account.

(b) If a data subject contacts us directly about Customer Personal Data and we can identify you as the controller, we forward the request to you without undue delay. We do not answer it ourselves, except to refer the data subject to you or where the law requires otherwise.

(c) We provide further reasonable assistance on request.

8.2 Security, breaches, impact assessments and consultation. Taking into account the nature of the processing and the information available to us, we assist you in complying with Articles 32 to 36 GDPR. In particular, we provide this DPA and its Annexes, the AI Features Notice and, on request, further information about the processing in the AI Features that you need for a data protection impact assessment or a prior consultation with a supervisory authority.

8.3 Costs. The self-service functions and the assistance described in this DPA are included in the Service. For assistance that goes beyond this and is not caused by a breach of this DPA by us, we may charge reasonable costs, provided we tell you in advance.

8.4 Authorities and records. We cooperate with supervisory authorities in the performance of their tasks on request. We keep a record of processing activities as required by Article 30(2) GDPR.

8.5 Data protection contact. Our data protection contact is legal@mailistix.com.

9. Personal Data Breaches

9.1 Notice. We notify you without undue delay after becoming aware of a Personal Data Breach. We aim to notify you within 48 hours.

9.2 Content. The notice includes, as far as the information is available:

(a) a description of the nature of the breach, including, where possible, the categories and approximate number of data subjects and of personal data records concerned;

(b) the name and contact details of our contact point for further information;

(c) the likely consequences of the breach; and

(d) the measures we have taken or propose to take to address the breach and to mitigate its possible adverse effects.

If we cannot provide all information at the same time, we provide it in phases without further undue delay.

9.3 Our measures. We take reasonable steps without undue delay to contain and investigate the breach, to mitigate its effects and to prevent a recurrence. We document the breach and keep you informed.

9.4 How we notify. We send the notice by email to the Account email addresses of the affected Authorized Users and to the data protection contact you have given us under Section 17.6.

9.5 Your duties. You decide whether the breach must be notified to a supervisory authority or to data subjects, and you make those notifications. We do not notify them on your behalf unless you instruct us to or the law requires it.

9.6 No admission. Our notice is not an acknowledgment of fault or liability.

9.7 Reports to us. Please report suspected security incidents involving the Service to legal@mailistix.com with a subject line starting with "Security:", as described in our Vulnerability Disclosure Policy.

10. Deletion and return

10.1 During the term. We keep Customer Personal Data in the Cloud Services only as long as Annex 1, Part H states. Automated daily jobs delete records whose retention period has ended.

10.2 Account deletion. An Authorized User can delete their Account in the Software at any time (Settings › General › Account › "Delete account"); Section 15.3 of the Terms describes when deletion is refused (for example, while a subscription can still charge). The deletion removes the Customer Personal Data of that Account from the Cloud Services. On the device used for the deletion, the Software also stops push notifications, revokes its access to connected Google mailboxes and erases the local data of that Account. You may also ask us in writing to delete the Accounts of your Authorized Users; we do so after verifying your authority.

10.3 End of the Terms for an Account. At the end of the provision of the Service for an Account, we return or delete its Customer Personal Data, at your choice (Article 28(3)(g) GDPR), as follows (Section 15.10 of the Terms):

(a) Return. You obtain a copy through the export in the Software (Section 8.1(a)), which an Authorized User can run at any time while the Account exists. Export and deletion are free of charge.

(b) Data-retrieval period. After the Terms end for an Account, for whatever reason, its Customer Personal Data remains available for retrieval for 30 days (the data-retrieval period under Section 15.10(d) of the Terms and Article 25(2)(g) of the Data Act). During that period, the Account remains in place and the Authorized User may sign in to export; if that is not possible, we send you the export on request to legal@mailistix.com. At the end of the period, we delete the Customer Personal Data of that Account from the Cloud Services, unless EU or Member State law requires us to store it. The retention periods in Annex 1, Part H continue to apply during the period.

(c) Immediate deletion. If an Authorized User deletes the Account in the Software (Section 10.2), or you ask us to delete it, you choose immediate deletion instead of a data-retrieval period: we delete the Customer Personal Data of that Account at once.

(d) Exportable data. For Customer Personal Data, the export file contains the Gmail and Outlook notification records, the Gmail watch and Outlook subscription registrations, and the records of support uploads (for example time, app version and size); we provide the content of support uploads on request (Section 15.10(b) of the Terms). Your Mailbox Data remains available to you at your mailbox provider and in the Software's local database on your devices; we hold no copy of it that we could return. Because we do not store the content of AI requests or AI Output, there is none to return or delete.

10.4 Backups. The database of the Cloud Services is backed up automatically once a day. Each backup is kept for 7 days, and Customer Personal Data in a backup is deleted when the backup expires. Backups remain protected under this DPA and are restored to the live system only to recover from an incident; after such a restore, we apply the deletions made since the backup again.

10.5 Subprocessors. Our AI Subprocessors may keep request data for a limited time for operational or abuse-monitoring purposes under their terms, as described in Annex 1, Part H.

10.6 Confirmation. On request, we confirm the deletion in writing.

11. Information and audits

11.1 Information. We make available to you the information necessary to demonstrate compliance with Article 28 GDPR and this DPA, in particular:

(a) this DPA, its Annexes and the Subprocessors page;

(b) answers to a reasonable security questionnaire once per calendar year; and

(c) the certifications and audit reports of our Subprocessors, as far as they make them available to us for this purpose.

11.2 Audits and inspections. If the information under Section 11.1 is not sufficient to demonstrate our compliance, if a supervisory authority requires it, or after a Personal Data Breach, you may audit our compliance with this DPA, including by inspections. You may carry out the audit yourself or through an independent auditor who is bound to confidentiality and is not our competitor. Unless a supervisory authority requires otherwise or the audit follows a Personal Data Breach:

(a) audits take place no more than once in any 12-month period;

(b) you give us at least 30 days' written notice and agree the scope and plan of the audit with us in advance; and

(c) audits take place during normal business hours without unreasonably disrupting our operations.

Audits do not extend to the data of other customers or to our trade secrets beyond what the audit requires. We do not operate data centers or servers of our own. For the facilities of our Subprocessors, the audit relies on their certifications and audit reports under Section 11.1(c).

11.3 Costs. You bear your own costs of an audit. You reimburse our reasonable, documented costs of supporting an on-site audit, unless the audit shows a material breach of this DPA by us.

11.4 Results. Audit results are confidential. You give us a copy of the audit report. We remedy any non-compliance found without undue delay.

11.5 SCCs. Where the SCCs apply, audits under their Clause 8.9 are carried out in accordance with this Section 11, as far as this is compatible with the SCCs.

12. International transfers

12.1 Where we process. We are established in Germany, a Member State of the European Union. We and our Subprocessors process Customer Personal Data in the EU, except as follows (details in Annex 3):

(a) for Authorized Users who answered "Outside Europe", some Gemini models run on Google's global endpoint (Section 4.3);

(b) Subprocessors established, or with their parent company, outside the EU may access Customer Personal Data from outside the EU for support and operations under their data processing terms; this applies to our contractual partner for hosting, Supabase Pte. Ltd. in Singapore, and its group, and to the U.S. parent companies of our other Subprocessors;

(c) only the server functions for AI requests are pinned to EU regions. The other server functions (for example mailbox connection, push-notification setup and relay, one-click unsubscribe, support upload and data export) run in the Supabase edge region nearest to the caller. For Authorized Users outside Europe, and for notifications sent by Google or Microsoft, they may therefore run outside the EU. The database and file storage stay in Frankfurt; and

(d) Gmail change notifications pass through Google Cloud Pub/Sub, which has no fixed processing region.

12.2 Onward transfers by us. We make a Restricted Transfer only on your documented instructions (this DPA, Annex 3 and the Region Setting) and only if the conditions of Chapter V GDPR, and the equivalent rules of the UK GDPR and the FADP, are met. For our Subprocessors, we rely on:

(a) an adequacy decision, including the EU–U.S. Data Privacy Framework, its UK Extension and the Swiss–U.S. Data Privacy Framework for certified recipients; or

(b) the SCCs (Module 3) or equivalent clauses in the Subprocessor's data processing terms, together with any supplementary measures that our transfer impact assessment shows to be necessary. For Supabase, these are the SCCs in Supabase's data processing addendum, with Supabase Pte. Ltd. (Singapore) as data importer; onward transfers to Supabase's own subprocessors are governed by that addendum.

12.3 Transfers between you and us. Whether the SCCs apply between you and us depends on where you are:

(a) You are established in the EEA: sending data to us in the EU, and our returning it to you, is not a Restricted Transfer. The SCCs do not apply between us.

(b) You are established in the United Kingdom, Switzerland or another country with an adequacy decision of the European Commission: UK and Swiss law recognize the EEA as providing adequate protection, and the EU recognizes the United Kingdom, Switzerland and the other countries concerned. The SCCs do not apply between us, unless Section 12.3(d) applies.

(c) You are established in any other country: your sending of data to us is not a Restricted Transfer under the GDPR, but our sending Customer Personal Data back to you (for example AI Output or an export) is one. For this case, Module 4 (processor to controller) of the SCCs applies, with us as data exporter and you as data importer, also where you act as processor for another controller (Section 2.3). Where your processing of the data is itself subject to the GDPR (Article 3(2) GDPR), the SCCs apply as far as they can be used for such a transfer, and you remain bound by the GDPR directly.

(d) We process outside the EEA: if we are, or become, established in a third country without an adequacy decision, or process Customer Personal Data there ourselves, Module 2 (where you are a controller) or Module 3 (where you are a processor) of the SCCs applies, with you as data exporter and us as data importer.

12.4 SCCs: incorporation and options. Where the SCCs apply under Section 12.3, they are incorporated into this DPA by reference, in the module that fits the case, and you and we enter into them by concluding this DPA. Acceptance of the Terms counts as signature of the SCCs and their Annexes. The following options and details apply:

(a) Clause 7 (docking clause): applies.

(b) Clause 9(a) (Modules 2 and 3): Option 2, general written authorization; the time period is 14 days, and notice is given under Section 7.3.

(c) Clause 11(a): the optional language does not apply.

(d) Clause 13(a) (Modules 2 and 3): the competent supervisory authority is determined as set out in Annex 1, Part J.

(e) Clause 17: for Modules 2 and 3, Option 1 applies, and the SCCs are governed by the law of Germany. For Module 4, the SCCs are governed by the law of Germany.

(f) Clause 18: disputes are resolved by the courts of Germany, with venue at our registered seat (Berlin, Germany). Clause 18(c) of Modules 2 and 3 remains unaffected.

(g) Annex I.A (list of parties) is Annex 1, Part A; Annex I.B (description of the transfer) is Annex 1; Annex I.C (competent supervisory authority) is Annex 1, Part J; Annex II (technical and organizational measures) is Annex 2; Annex III (list of subprocessors) is Annex 3.

(h) The certification of deletion under Clause 8.5 is given on request under Section 10.6; audits under Clause 8.9 follow Section 11.

12.5 UK transfers. Where a transfer of Customer Personal Data between you and us is a Restricted Transfer under the UK GDPR, the UK Addendum is incorporated into this DPA and applies to the SCCs incorporated under Section 12.4. Its Tables are completed as follows:

(a) Table 1 (Parties): the parties, their details and their contacts as set out in Annex 1, Part A; the start date is the date on which this DPA became binding between us.

(b) Table 2 (Selected SCCs, Modules and Selected Clauses): the version of the Approved EU SCCs incorporated under Section 12.4, including the Appendix Information, with the modules and options selected there.

(c) Table 3 (Appendix Information): the list of parties is Annex 1, Part A; the description of the transfer is Annex 1; the technical and organizational measures are Annex 2; the list of subprocessors is Annex 3.

(d) Table 4 (Ending this Addendum when the Approved Addendum changes): the Importer may end the UK Addendum.

Part 2 of the UK Addendum, the Mandatory Clauses of the Approved Addendum (template Addendum B1.0 issued by the Information Commissioner and laid before Parliament under section 119A of the Data Protection Act 2018, as revised under Section 18 of those Mandatory Clauses), applies.

12.6 Swiss transfers. Where a transfer is subject to the FADP:

(a) references to the GDPR in the SCCs are read as references to the FADP, as far as the transfer is subject to the FADP;

(b) the Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority under Clause 13 for transfers subject to the FADP; where a transfer is subject to both the FADP and the GDPR, the authority under Annex 1, Part J remains competent for the part governed by the GDPR;

(c) the governing law under Clause 17 remains the law chosen in Section 12.4(e); and

(d) the term "Member State" in Clause 18(c) must not be interpreted so as to exclude data subjects in Switzerland from suing for their rights in their place of habitual residence, Switzerland.

12.7 Changes to transfer mechanisms. If a transfer mechanism relied on under this Section 12 is invalidated, amended or replaced, we cooperate with you to put an alternative lawful mechanism in place. We may update this Section 12 to a new version of the SCCs or the UK Addendum by notice to you; the update takes effect when the law requires it.

13. Requests from public authorities

13.1 We disclose Customer Personal Data to a public authority only where a binding order legally requires us to. We do not disclose it voluntarily, and we have not built any means for authorities to access it directly.

13.2 If we receive such an order, we:

(a) try to redirect the authority to request the data directly from you;

(b) notify you promptly, unless the law prohibits it; if it does, we use reasonable efforts to obtain a waiver of the prohibition so that we can inform you as soon as possible;

(c) review the legality of the order and challenge it if, after careful assessment, we conclude that there are reasonable grounds to consider it unlawful under the law of the country concerned, applicable obligations under international law or principles of international comity, including by seeking interim measures where appropriate, and we do not disclose the data until the applicable procedural rules require us to;

(d) disclose only the minimum data the order requires, based on a reasonable interpretation of it; and

(e) document the order, our assessment and our response, and make this documentation available to you on request where the law permits.

13.3 We can only disclose what we hold (Annex 1, Part H). We do not hold your Mailbox Data or the local copy in the Software, and we do not store the content of AI requests or AI Output.

13.4 When this DPA is published, we have not received any order or request from a public authority for Customer Personal Data, and we have no reason to believe that the laws that apply to us prevent us from fulfilling our obligations under this DPA.

13.5 Non-personal data (Article 32 of the Data Act). Sections 13.1 to 13.3 apply equally to non-personal data in Customer Content that we hold in the Cloud Services in the EU. We give a court or authority of a country outside the EU access to such data, or transfer it to one, only under the conditions of Article 32(2) and (3) of the Data Act, and then provide only the minimum amount of data permissible, based on a reasonable interpretation of the request. We inform you of such a request before complying with it, unless the request serves law enforcement purposes and for as long as this is necessary to preserve the effectiveness of the law enforcement activity.

13.6 Information under Article 28(1) of the Data Act. Section 4 of our Subprocessors page (part of Annex 3) sets out the jurisdiction to which the ICT infrastructure of the Cloud Services is subject and the measures we take against unlawful international governmental access; this Section 13 and Annex 2 describe those measures in detail.

14. Your obligations

14.1 Lawfulness. You are responsible for the lawfulness of the processing of Customer Personal Data. This includes having a legal basis for using the AI Features with the emails of your correspondents and other third parties, and informing data subjects where Data Protection Laws require it.

14.2 Special categories and criminal offense data. The Service is not designed to process special categories of personal data (Article 9 GDPR) or personal data relating to criminal convictions and offenses (Article 10 GDPR), and we do not process such data intentionally. It may, however, appear in emails that the AI Features process. You decide whether your Authorized Users may use the AI Features with such content, and you make sure that a legal basis exists for it (see the Acceptable Use Policy).

14.3 Your users and your setup. You make sure that:

(a) your Authorized Users use the Service in line with your instructions and this DPA, including the Region Setting (Section 4.3) and the decision to enable the AI Features;

(b) any consent or involvement of employee representatives that your use of the Service requires has been obtained;

(c) any administrator consent that your mailbox provider requires has been given; and

(d) you comply with any obligations of professional secrecy that apply to you.

14.4 Irregularities. You inform us without undue delay if you notice errors or irregularities in the processing of Customer Personal Data.

15. Liability

15.1 Our liability arising out of or in connection with this DPA, including the SCCs as far as they permit, is subject to the exclusions and limitations of liability in the Terms (Part II, Section A.1 or, where it applies, Sections 16 and 17 of Part I), to the extent permitted by Article 82 GDPR and other applicable law. Your liability is governed by statutory law.

15.2 Section 15.1 does not limit:

(a) either party's liability to data subjects, including under Article 82 GDPR, the equivalent provisions of other Data Protection Laws and the third-party beneficiary rights under the SCCs; or

(b) any liability that cannot be limited or excluded under applicable law.

15.3 Between the parties, and within the limits of Section 15.1, each party bears the part of any compensation paid to a data subject that corresponds to its part of the responsibility for the damage (Article 82(5) GDPR).

16. U.S. state privacy laws

16.1 Where the California Consumer Privacy Act (as amended by the California Privacy Rights Act) or a comparable U.S. state privacy law applies to Customer Personal Data, we act as your "service provider" or "processor". We:

(a) do not sell or share Customer Personal Data, as those terms are defined in those laws;

(b) do not retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purposes specified in the Terms and this DPA, or outside the direct business relationship between you and us;

(c) do not combine Customer Personal Data with personal information we receive from or on behalf of others, or collect from our own interactions with consumers, except as those laws permit;

(d) comply with the obligations of those laws that apply to us and provide the same level of privacy protection as they require; and

(e) notify you if we determine that we can no longer meet our obligations under those laws.

16.2 You may take reasonable and appropriate steps under Sections 9 and 11 to ensure that we use Customer Personal Data in line with those laws, and to stop and remediate unauthorized use. We certify that we understand the restrictions in this Section 16 and will comply with them.

17. Term and general provisions

17.1 Term. This DPA applies as long as the Terms are in force for any of your Accounts and, after that, as long as we process Customer Personal Data on your behalf. It cannot be terminated separately from the Terms. Sections 5, 10, 13 and 15 survive its end.

17.2 Changes. We may change this DPA under the rules for changes in the Terms (Sections 19.3 and 19.6 of the Terms), in particular to reflect changes in Data Protection Laws, decisions of authorities or courts, new versions of the SCCs or the UK Addendum, or changes to the Service. A new version of this DPA gets a new version number, and the Software asks your Authorized Users to accept it (Section 1.1 and Section 1.8(b) of the Terms). A change that reduces the protection of Customer Personal Data takes effect for you only if you agree to it. Changes required by law take effect when the law requires. Changes of Subprocessors follow Section 7 instead.

17.3 Severability. If a provision of this DPA is or becomes invalid or unenforceable, the remaining provisions remain in force; Section 23.3 of the Terms applies.

17.4 Governing law and venue. This DPA is governed by the law of the Federal Republic of Germany, also where the Terms are governed by another law, because Article 28(3) GDPR requires a contract under Union or Member State law. The provisions of the Terms on venue and dispute resolution apply, except where the SCCs or Data Protection Laws require otherwise.

17.5 Language. The English version of this DPA is the original. Translations are provided for convenience. Where mandatory law in your country requires that the version in your language prevails, it does.

17.6 Notices. We send notices under this DPA by email to the Account email addresses of your Authorized Users and, if you have given us one, to your data protection contact. Please send notices to us at legal@mailistix.com. You may give us or change your data protection contact at that address at any time.

Signature (only for copies signed on request under Section 1.1)

Annex 1 — Description of the processing

This Annex describes the processing under Article 28(3) GDPR and serves as Annex I to the SCCs where they apply.

Part A — Parties

Part B — Categories of data subjects

• Authorized Users: your employees, contractors and other persons who use the Service with Accounts for your business purposes, including the holders of Connected Mailboxes.
• Correspondents: senders and recipients (To, Cc) of the emails processed, and other participants in the email threads concerned.
• Persons named or otherwise identifiable in email text, subjects, signatures, attachment names, attachment text passages and links.
• Organizers and attendees of meetings for which a briefing is requested, and persons named in the invitation.
• Contacts whose names and email addresses are sent with an Ask AI question as the Authorized User's most frequent correspondents, or whose language and formality preferences are sent with a draft request.

Part C — Categories of personal data

Draft and rewrite requests also contain the name, email address and time zone of the Authorized User who starts them; Ask AI and meeting briefing requests contain the current date and the Authorized User's time zone.

The models used within the providers listed in Annex 3 may change, including for quality comparisons. Such changes always stay within the Subprocessors and processing regions set out in Annex 3 and the Authorized User's Region Setting.

Part D — Special categories of personal data and criminal offense data

The Service does not intentionally process special categories of personal data or data relating to criminal convictions and offenses. Such data may appear incidentally in the content of emails, attachments or meetings that an Authorized User sends to an AI Feature (Section 14.2). The following safeguards apply to all Customer Personal Data, including such data: processing only when an Authorized User starts a feature; no storage of AI request content or AI Output; no use for training; no human review except under Section 5.2; encryption in transit; processing in the EU for Authorized Users with the Region Setting "In Europe" or no answer; and the measures in Annex 2.

Part E — Nature of the processing

Receiving the request from the Software; assembling the prompt on the server from the data the feature needs; transmitting it to an AI model of a Subprocessor and returning the Output to the Software (streamed where the feature supports it); relaying OAuth exchanges and one-click unsubscribe requests; receiving, storing for a short time and passing on push notifications; storing support uploads; deleting all of these on schedule.

Part F — Purposes

To provide the Service to you, namely: generating the AI Output that an Authorized User requests; connecting Connected Mailboxes; telling the Software about new or changed mail in real time; unsubscribing from newsletters without revealing the Authorized User's IP address to the sender; and handling support requests.

Part G — Duration and frequency

The processing lasts for the term of this DPA (Section 17.1) plus the deletion periods in Part H. It takes place continuously, each time an Authorized User starts a feature or a Connected Mailbox changes.

Part H — Retention

For your information: usage metadata of AI requests (without content) is kept for 180 days, and security event records for 180 days. We process them as an independent controller (Section 2.4).

Part I — Processing locations

• Database and file storage of the Cloud Services: Frankfurt, Germany (Amazon Web Services, operated by Supabase). Supabase Pte. Ltd. (Singapore) and its group may access them for support and operations (Section 12.1(b)).
• Server functions for AI requests: EU edge regions of Supabase only; Frankfurt by default, and the configuration admits only Frankfurt, Ireland and Paris.
• AI models: Microsoft Azure OpenAI in the EU Data Zone; Google Vertex AI in the EU multi-region; for Authorized Users who answered "Outside Europe", some Gemini models on Google's global endpoint.
• Gmail notifications: Google Cloud Pub/Sub (Google's global infrastructure, no fixed region).
• Support emails and contact form messages: Microsoft 365, EU Data Boundary; contact form messages pass through Cloudflare's network.
• Other server functions: the Supabase edge region nearest to the caller, which can be outside the EU (Section 12.1(c)).

Part J — Competent supervisory authority

• For Modules 2 and 3 (Clause 13): (i) if you are established in an EU Member State, the supervisory authority competent for you there; (ii) if you are not established in the EU but are subject to the GDPR under Article 3(2) and have appointed a representative under Article 27(1), the supervisory authority of the Member State in which your representative is established; (iii) if you are not established in the EU, are subject to the GDPR under Article 3(2) and need not appoint a representative (Article 27(2)), the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, as the authority of a Member State in which data subjects concerned are located.
• For transfers subject to the UK GDPR: the Information Commissioner's Office. For transfers subject to the FADP: the FDPIC (Section 12.6).
• Our own supervisory authority: the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

Annex 2 — Technical and organizational measures

This Annex describes the measures under Article 32 GDPR, structured along the headings of Article 32 GDPR and ISO/IEC 27001. Part A covers the Cloud Services, which are within our responsibility. Part B describes the security functions of the Software, which runs under your control (Section 3). This Annex describes only measures that are in place.

Part A — Cloud Services

A.1 Governance and personnel

• Responsibility for information security and data protection: Marvin Muvunyi (managing director). Data protection contact: legal@mailistix.com.
• Internal policies on retention and deletion and on incident response and breach notification, reviewed at least once a year.
• Persons with access to Customer Personal Data are bound to confidentiality (Section 5) and instructed on data protection and security. Access ends when it is no longer needed.
• There is no application administration interface. Administration takes place only in the consoles of our providers (Supabase, Google Cloud, Microsoft Azure and Entra, Polar, GitHub, Cloudflare). Access to them is limited to our managing director.

A.2 Physical access control

• We operate no data centers or servers of our own. The Cloud Services run in data centers of Supabase (on Amazon Web Services), Google and Microsoft, whose physical security is certified under recognized standards such as ISO/IEC 27001 and SOC 2.
• Devices used for administration have full-disk encryption, an automatic screen lock and a supported operating system.

A.3 System access control (authentication)

For Authorized Users (Supabase Auth):

• No passwords: sign-up and sign-in only with a 6-digit one-time code sent to the Account email address, valid for 15 minutes, single use, generated from a cryptographically secure random source; it also confirms the email address.
• Rate limits per IP address for sign-in, sign-up and code verification, and a limit on account emails.
• Sessions: access tokens valid for 1 hour; refresh tokens rotate; a session ends after 90 days without use. Signing out revokes all refresh tokens of the user.
• Deleting an Account requires a one-time code sent to the Account email address, entered within the last 10 minutes, and a typed confirmation. A change of email address must be confirmed from both addresses.
• No default accounts and no static administrator keys on any exposed interface.
• Mailbox access uses the OAuth 2.0 authorization code flow with PKCE (S256) in the system browser. The state value is random, single use and valid for 10 minutes. Client secrets exist only on the server.

For administrators:

• Administration takes place only in the provider consoles named in A.1, through personal accounts of our managing director; there are no shared administrator accounts.
• Privileged database functions, such as deleting an Account on request or extending a trial, can be run only by the database owner role in the provider's console, not through the API of the Cloud Services.

A.4 Data access control (authorization)

• Row-level security is enabled on all tables of the public database schema; policies compare each record's user with the authenticated user. The only shared table is a read-only table of Plan limits.
• The anonymous role has no table privileges. The authenticated role has only the privileges that a policy backs. Database privileges are compared with a reviewed snapshot after each database migration.
• All privileged database functions (SECURITY DEFINER) use an empty search path; those that users can call derive the user from the verified token.
• Server functions verify the access token and resolve the user through Supabase Auth. They never take a user ID from the request, scope every query to that user and fail closed.
• Webhooks determine the mailbox owner from server-side registries written under the authenticated user, never from the notification content.
• Support uploads are stored in a private storage bucket and are never served back.
• Server-side secrets are kept in Supabase Edge Function secrets and Vault, not in source code. Secret scanning covers the source and its full history. The Software package contains only an allowlisted public configuration.

A.5 Separation control

• Each user's records are separated logically by row-level security and user-scoped queries.
• Each AI request is processed separately; nothing from it is kept on the server between requests.

A.6 Pseudonymization and data minimization

• The content of AI requests and AI Output is not stored; usage is recorded as metadata without content.
• Prompts are assembled on the server from only the data the feature needs, within fixed size limits (Annex 1, Part C).
• Server function logs contain codes and counts only, no tokens, addresses or content; our hosting provider keeps them for up to 90 days.
• Push notifications carry no email content. Unsubscribe links are neither logged nor stored.
• Per-subscription webhook secrets are stored only as SHA-256 hashes.
• Security event records lose the user ID when the Account is deleted.
• Optional telemetry uses a random pseudonymous identifier and never contains email content or AI texts.

A.7 Encryption

• In transit: TLS 1.2 or 1.3 on all connections between the Software, the Cloud Services, our Subprocessors and the mailbox providers. No certificate check is disabled anywhere, and release builds of the Software refuse switches that weaken TLS. The API endpoints use HSTS.
• At rest: the database and file storage are encrypted by Supabase (AES-256); server-side secrets are encrypted at rest by the platform.

A.8 Transfer control

• AI requests run only in EU edge regions of Supabase; the server functions refuse to process AI requests in any other region.
• AI providers are called only at fixed endpoints. Microsoft Azure OpenAI is called with response storage switched off.
• Webhooks are authenticated: Polar by HMAC-SHA256 over the raw body with constant-time comparison and timestamps no older than 5 minutes; Google Pub/Sub by a Google-signed OIDC token checked for issuer, audience, the pinned service account and a lifetime of at most 1 hour; Microsoft Graph by a random 256-bit secret per subscription. Request bodies are size-limited.
• Cross-origin requests are restricted by an allowlist, without credentials.
• One-click unsubscribe requests go only to HTTPS addresses that resolve to public IP addresses, without cookies, credentials or referrer, and redirects are not followed.
• Customer Personal Data is passed only to the Subprocessors listed in Annex 3.

A.9 Input control (logging)

• A security event trail records events such as a mailbox connected or a failed connection, a trial extended by an administrator, or an AI answer held back by the leak guard, with time, outcome and code (180 days).
• AI usage records contain feature, model, status, tokens, Credits and time, without content (180 days).
• Logs of the Software and the server functions pass through central redaction of credentials, tokens and email content.
• Administrative actions in Google Cloud are logged by Google (Admin Activity audit logs).

A.10 Availability and resilience

• The Cloud Services run on managed infrastructure (Supabase on Amazon Web Services, Frankfurt).
• Backups: a daily backup of the database of the Cloud Services, kept for 7 days (Section 10.4); after a restore, the deletions made since the backup are applied again. Customer Personal Data in the Cloud Services is short-lived (Annex 1, Part H), and Mailbox Data does not depend on the Cloud Services.
• AI requests use fallback chains across Microsoft Azure OpenAI and Google Vertex AI, and a circuit breaker for failing providers, so that the outage of one provider does not stop the AI Features.
• Rate limits and a daily AI spending limit per user protect against overload and abuse.
• Mailbox Data remains available at the mailbox provider independently of the Cloud Services.
• Errors of the server functions are reported to Sentry (EU region) as error codes, without content; an alarm about a held-back AI answer also carries a hash of the user ID.

A.11 Incident management

• A documented procedure for detection, containment, assessment, notification, recovery and review of incidents; notification of Business Customers under Section 9.
• A public reporting channel for vulnerabilities under the Vulnerability Disclosure Policy.

A.12 Regular testing, assessment and evaluation

• Static code analysis of the Software and the server functions before release.
• Automated test suites, including tests of the security boundaries of the Software and the server functions; scheduled CI runs.
• Automated dependency alerts and security updates; vulnerability checks of production dependencies (npm audit, OSV); secret scanning.
• Checks of the TLS configuration of our endpoints.
• Review of this Annex at least once a year and after material changes.

A.13 Job control (Subprocessors)

• Subprocessors are selected for their security and data protection guarantees and bound by contracts under Article 28(4) GDPR.
• Configuration that limits processing: EU regions for AI requests and AI models (for the Region Setting "In Europe" or no answer), Azure OpenAI in the EU Data Zone, response storage off, no training under the providers' terms.
• Personnel act only on instructions; Customer Personal Data is not used for our own purposes (Section 4.6).

A.14 Data protection by design and by default

• The AI Features are off until an Authorized User enables them in a consent dialog, and can be switched off at any time.
• The region default is the EU: without an answer, AI processing stays in the EU.
• Telemetry and crash reports only with opt-in.
• The Software never sends an email or a meeting reply on its own; drafts are sent only by the Authorized User.
• Remote images in emails are blocked by default.
• Automated deletion jobs enforce the retention periods in Annex 1, Part H.

A.15 Safeguards specific to AI

• Email content is passed to the model as marked, untrusted data; instructions to the model are held only on the server.
• A leak guard holds back answers that reproduce internal instructions and records the event without the answer text.
• The models cannot take actions: they cannot send, delete or change anything in a mailbox, and every Output is shown to the Authorized User.

Part B — Security functions of the Software (under your control)

• The local mail database is encrypted with ChaCha20-Poly1305 (SQLite3MultipleCiphers) under a random 256-bit key, which the operating system's credential store protects (macOS Keychain, Windows Data Protection API). The key file is readable by the owner only. Release builds refuse to open an unencrypted database.
• Mailbox tokens and the Mailistix session are encrypted with the operating system's credential store and are not kept in browser storage.
• Opened attachments are cached encrypted (AES-256-GCM) for at most 7 days and 512 MiB; temporary plaintext copies are deleted after 10 minutes. The local support log is encrypted and kept for at most 7 days.
• Log output is redacted of credentials, tokens, addresses and email content.
• Email HTML is sanitized and displayed in a sandboxed frame without scripts, under a Content Security Policy. Remote images are blocked by default. Attachment previews run in a sandbox without network access. File access is restricted to the Software's own folders.
• Mailbox sign-in takes place in the system browser, not in an embedded browser.
• The macOS build uses the hardened runtime. Updates are downloaded over HTTPS and installed only after the user confirms; the signature of the Windows installer is checked.
• Removing a Connected Mailbox stops its push notifications, deletes its local mail and revokes access to a Google mailbox. Deleting the Account erases the local data of that Account on the device.
• Your responsibility: security of devices and operating-system accounts, device encryption, screen lock, backups, and deletion of local data when a device is retired.

Annex 3 — Subprocessors

The authorized Subprocessors, with the data they process, their processing locations and the transfer safeguards, are listed on our Subprocessors page. That page forms part of this Annex; changes follow Section 7. The table below summarizes the Subprocessors that process Customer Personal Data. Providers that process only data for which we are an independent controller (for example optional product analytics, error reports of the app, and account emails) are also listed on that page but are not Subprocessors under this DPA.

Each Subprocessor uses its own subprocessors (for example, Supabase uses Amazon Web Services), which it lists in its own documentation.