Mailistix Subprocessors
This page lists the third parties that process personal data on our behalf ("subprocessors") to provide the Mailistix Service. It forms Annex 3 of our Data Processing Agreement and supplements our Privacy Policy. The last column shows which subprocessors process Customer Personal Data that we process on behalf of Business Customers under the Data Processing Agreement; the others process only data for which we are the controller. Section 4 contains the information required by Article 28(1) of the EU Data Act.
What never reaches a subprocessor: your mailbox is synchronized directly between the Mailistix app on your device and your mailbox provider (for example Google or Microsoft). Your emails are stored only on your device, in an encrypted database. Email content reaches our servers and the AI providers below only when you use an AI Feature, and only for the time needed to answer that request. Apart from that, our servers receive only technical data about your mailboxes (such as the mailbox address and change notifications without content), the sign-in codes and tokens for a mailbox when you connect it (passed through, not stored), the unsubscribe link of a newsletter you unsubscribe from, and what you choose to send us for support.
1. Subprocessors
| Subprocessor | Service | Personal data processed | Processing location | Transfer safeguard | Applies to | Subprocessor under the DPA |
|---|---|---|---|---|---|---|
| Supabase Pte. Ltd. (Singapore; Supabase group, including Supabase, Inc., USA), hosted on Amazon Web Services | Database, authentication, server functions (Edge Functions), file storage (support uploads, app update files), relay of push notifications about new mail | Account data (email address, password hash, settings, Region Setting, consent records, records of acceptance of the Terms), Plan and Credit records, AI usage metadata (no content), security events, pseudonymous mailbox fingerprints, push-notification metadata (mailbox address and change cursor; Outlook subscription and message IDs), support uploads; transient pass-through of AI requests and AI Output, OAuth tokens and one-click unsubscribe links (not stored) | Database and file storage: Frankfurt, Germany (Amazon Web Services). Server functions for AI requests: EU regions only (Frankfurt by default). Other server functions: the Supabase edge region nearest to the caller, which can be outside the EU for users outside Europe | EU SCCs in the Supabase DPA (Module 2 for data we control, Module 3 for Customer Personal Data), with UK and Swiss addenda; Singapore has no EU adequacy decision; not certified under the EU-U.S. Data Privacy Framework | All users | Yes |
| Microsoft Ireland Operations Limited / Microsoft Corporation (Azure OpenAI in Azure AI Foundry) | AI model processing (drafts, rewrites, summaries, Ask AI including fact extraction, meeting briefings, writing style, learning from your edits) | Content of the AI request (email text, thread, your instructions, your name, email address and time zone) and the AI Output | EU Data Zone (resource in Sweden Central; requests may be processed in any Azure region of the EU Data Zone). Response storage switched off | Microsoft Products and Services DPA; EU Data Boundary; EU-U.S. Data Privacy Framework (Microsoft Corporation) and SCCs | All users using AI Features | Yes |
| Google Cloud EMEA Limited / Google LLC (Vertex AI) | AI model processing (Gemini models) | Content of the AI request and the AI Output | Users in the EU or who have not answered the region question: Vertex AI EU multi-region. Users outside the EU: some Gemini models on Google's global endpoint (any country where Google operates); the others in the EU multi-region | Google Cloud Data Processing Addendum; EU-U.S. Data Privacy Framework (Google LLC) and SCCs | All users using AI Features | Yes |
| Google Cloud EMEA Limited / Google LLC (Cloud Pub/Sub) | Relaying Gmail change notifications to our server | Gmail address and an opaque change cursor (no email content), kept for up to 1 hour | Google's global infrastructure, no fixed region | as above | Users with a connected Gmail mailbox | Yes |
| Microsoft Ireland Operations Limited / Microsoft Corporation (Microsoft 365) | Our email system, including legal@, delivery of the messages from the contact form on mailistix.com to legal@ with a confirmation without their content to the sender, delivery of the entries of the waitlist for the beta to a mailbox of ours with a confirmation to the person who joined, and sending account emails (sign-in and confirmation codes, confirmation of email changes and other account notices) | Emails you send us, messages from the contact form and our replies: name, email address, content; waitlist entries: email address, platform, time of consent; account emails: email address, the code or link, language | European Union (EU Data Boundary) | Microsoft Products and Services DPA; EU-U.S. Data Privacy Framework (Microsoft Corporation) and SCCs | All users (account emails); people who email us, use the contact form or join the waitlist | Yes, where an email or a contact form message contains Customer Personal Data |
| Microsoft Ireland Operations Limited / Microsoft Corporation (Azure Blob Storage) | Storage of daily checksums (unchangeable for 4 years and 1 month) and a 30-day backup copy of our records of acceptances of the Terms and the DPA, as evidence | Checksums only (no readable data); in the backup copy: user ID, SHA-256 hash of the email address, accepted or objected versions, times, document and wording checksums; no email content | Germany (Germany West Central; geo-redundant copy in Germany North) | Microsoft Products and Services DPA; EU-U.S. Data Privacy Framework (Microsoft Corporation) and SCCs | All users | No |
| Functional Software, Inc. (Sentry), USA | Error monitoring: (a) crash and error reports from the app — only with your opt-in, and not sent by the current version of the app; (b) operational errors of our server functions | (a) Pseudonymized technical error data, app version, operating system; no email content, no account identifiers. (b) Error codes and function names; for the alarm about a held-back AI answer, also a hash of your user ID; no content | Germany (Sentry EU region) | Sentry DPA; EU-U.S. Data Privacy Framework and SCCs | (a) Opt-in only; (b) all users | No |
| PostHog, Inc. (USA) | Product analytics — only with your opt-in | Pseudonymous random identifier, allow-listed usage events (for example onboarding steps, plan category); no email content or figures derived from your mailbox, no IP-based location | Germany/EU (PostHog EU Cloud, Frankfurt) | PostHog DPA; EU-U.S. Data Privacy Framework and SCCs | Opt-in only | No |
| Cloudflare, Inc. (USA) | DNS, content delivery and hosting of the website mailistix.com (Cloudflare Pages), including the server functions for the password protection, the contact form and the waitlist | IP address and request data of website visitors; the abuse counters of the contact form and the waitlist, which hold only hashes of IP addresses and email addresses; page-view and loading-time statistics of visitors outside the EU (Cloudflare Web Analytics); the content of contact form messages and waitlist entries in transit (not stored) | Global edge network (the data center nearest to the visitor) | Cloudflare DPA; EU-U.S. Data Privacy Framework and SCCs | Website visitors | Yes, where a contact form message contains Customer Personal Data (passed through to Microsoft 365, not stored) |
| Google Cloud EMEA Limited / Google LLC (reCAPTCHA) | Spam protection of the contact form and the waitlist on mailistix.com, loaded only after the visitor allows it in the dialog of the form or the waitlist | IP address, browser and device data, interaction with the contact page or the waitlist dialog, reCAPTCHA cookie | Google's global infrastructure, including the USA | Google Cloud Data Processing Addendum; EU-U.S. Data Privacy Framework (Google LLC) and SCCs | Website visitors who allow reCAPTCHA | No |
Our AI providers may keep request data for a limited time for operational and abuse-monitoring purposes under their terms: Google Vertex AI up to 24 hours in memory (caching) and up to 90 days for prompts flagged as possible abuse, Microsoft Azure OpenAI up to 30 days; authorized employees of the provider may review flagged requests. See the AI Features Notice and Annex 1 of the Data Processing Agreement. Each subprocessor uses its own subprocessors (for example, Supabase uses Amazon Web Services), which it lists in its own documentation.
2. Independent controllers (not subprocessors)
These parties receive personal data but decide themselves how to process it. Their own privacy policies apply.
| Party | Role | Data |
|---|---|---|
| Polar Software, Inc. (USA) | Merchant of record and reseller for the paid Pro Plan; handles checkout, payment, taxes, invoices, refunds and chargebacks, using its own payment processors | When you first open the checkout, we create your customer record at Polar with your email address and Mailistix user ID; afterwards we keep its email address up to date. If you never open the checkout, Polar receives nothing about you. At checkout, Polar also receives your IP address and collects your name, billing address and payment details (we never see full card data). Polar sends us your subscription status and the name and email address of your customer record. |
| Google and Microsoft as your mailbox providers | Provide the mailbox you connect under your own contract with them, including the sign-in (OAuth) and token services you authorize and, for Microsoft, the change notifications sent to our server | Everything in your mailbox; they see the app's API requests |
| Senders of newsletters you unsubscribe from | Receive the one-click unsubscribe request, sent from our server so that they do not see your IP address | The unsubscribe link they put in their newsletter |
| Apple, Microsoft (operating systems) | Keychain/credential storage on your device, code-signing checks | Handled on your device by your operating system |
Polar is located in the United States and is not certified under the EU-U.S. Data Privacy Framework. Our agreement with Polar includes Polar's data processing addendum with the EU Standard Contractual Clauses; where these do not cover a transfer, it is necessary for the purchase requested (Article 49(1)(b) GDPR). See section 9.5 of the Privacy Policy.
3. Changes to this list
We will announce new subprocessors on this page at least 14 days before they start processing personal data. Business Customers are also informed by a notice to the Account email addresses of their users or in the Software, and by email to their data protection contact if they have given us one (Section 7.3 of the Data Processing Agreement). Business Customers may object as described in Section 7 of the Data Processing Agreement. In an emergency (for example to keep the Service secure or available) we may engage a replacement sooner and will inform you without undue delay; where the EU Standard Contractual Clauses apply, their notice rules prevail.
4. Information under the EU Data Act
Article 28(1) of the EU Data Act (Regulation (EU) 2023/2854) requires providers of data processing services to state on their website the jurisdiction to which the ICT infrastructure used for each of their services is subject, and the measures they take against international governmental access to data held in the EU that would conflict with EU law or the law of a Member State. Your switching and data-retrieval rights under the Data Act are set out in Section 15.10 of our Terms of Service.
4.1 Infrastructure and jurisdiction
| Part of the Service | Infrastructure | Location | Operator and the laws it is subject to |
|---|---|---|---|
| The Mailistix app and its local database (your emails, attachments, drafts, projects and other local data) | Your own devices | Wherever you use them | You; the law of the place where your devices are |
| Database, authentication and file storage of the Cloud Services | Supabase on Amazon Web Services | Frankfurt, Germany | Supabase Pte. Ltd. (Singapore) and Amazon Web Services (USA): German and EU law at the location; the operators are also subject to the laws of Singapore and the United States |
| Server functions for AI requests | Supabase Edge Functions | EU only (Frankfurt by default; Ireland or Paris as alternatives) | As above |
| Other server functions (for example mailbox connection, push notifications, checkout, data export, one-click unsubscribe) | Supabase Edge Functions | The Supabase edge region nearest to the caller, which can be outside the EU | As above, and the law of the country of that region |
| AI processing by Microsoft | Azure OpenAI | EU Data Zone (resource in Sweden Central) | Microsoft Ireland Operations Limited (Ireland) and Microsoft Corporation (USA): EU law at the location; also US law |
| AI processing by Google | Vertex AI | EU multi-region; for users who answered "Outside Europe", some models on Google's global endpoint | Google Cloud EMEA Limited (Ireland) and Google LLC (USA): EU law at the location, or the law of the country where the global endpoint processes the request; also US law |
| Gmail change notifications | Google Cloud Pub/Sub | Google's global infrastructure, no fixed region | Google Cloud EMEA Limited and Google LLC: the law of the location; also US law |
| Our email system (support, contact form, waitlist, account emails) | Microsoft 365 | EU (EU Data Boundary) | Microsoft Ireland Operations Limited and Microsoft Corporation: EU law at the location; also US law |
| Evidence checksums and backup copies of acceptance records | Microsoft Azure Blob Storage | Germany (Germany West Central, Germany North) | Microsoft Ireland Operations Limited and Microsoft Corporation: German and EU law at the location; also US law |
| Error monitoring and optional analytics | Sentry EU region; PostHog EU Cloud | Germany | Functional Software, Inc. and PostHog, Inc. (USA): German and EU law at the location; also US law |
| Website mailistix.com | Cloudflare Pages | Cloudflare's global network | Cloudflare, Inc. (USA): the law of the location of the data center; also US law |
4.2 Measures against unlawful governmental access
- Technical: your mailbox data stays on your devices, in an encrypted database whose key your operating system protects; we hold no copy of it. We do not store the content of AI requests or of the AI Output. Our database and file storage are in Frankfurt and our server functions for AI requests run only in EU locations; they refuse AI requests in any other region. All connections are encrypted (TLS 1.2 or 1.3), and our database and file storage are encrypted at rest (we currently keep no database backups). We keep only the data the Service needs and delete it on fixed schedules (Annex 1, Part H of the Data Processing Agreement).
- Organizational: we disclose data to a public authority only where a binding order legally requires it. We then try to redirect the authority to the customer, notify the customer unless the law prohibits it, review the order and challenge it where there are reasonable grounds to consider it unlawful, disclose only the minimum the order requires and document our response (Section 13 of the Data Processing Agreement). We have not built any means for authorities to access data directly.
- Contractual: our providers are bound by data processing terms. Where the EU Standard Contractual Clauses apply, their Clause 15 obliges the provider to notify us of requests from public authorities, to review their legality and to challenge them where there are grounds to do so. Microsoft and Google also publish their own commitments to challenge government requests for customer data.