1. How to read this list
When MessageMind processes personal data on a customer's behalf we act as processor under Article 28 GDPR. The companies below are our sub-processors: they may process that data to deliver part of the service.
Not every sub-processor applies to every customer. A vendor is only engaged where the customer enables the corresponding channel, integration or feature. Systems the customer connects themselves — their own CRM, shop, PMS or booking platform — are the customer's own controllers or processors, not ours.
2. Current sub-processors
| Sub-processor | Purpose | Data categories | Processing location |
|---|---|---|---|
| Meta Platforms Ireland Ltd | WhatsApp Business and Instagram messaging channels | Message content, profile identifiers, phone numbers | EU / US |
| OpenAI, L.L.C. | Text generation for AI agent replies | Conversation content submitted for generation | US |
| ElevenLabs Inc. | Speech synthesis and voice agent audio | Text prompts and generated or supplied audio | US / EU |
| Twilio Inc. | SMS and voice telephony | Phone numbers, message content, call metadata | US / EU |
| Telnyx LLC | Telephony and messaging (alternative carrier) | Phone numbers, message content, call metadata | US / EU |
| Stripe Payments Europe Ltd | Subscription billing and customer deposits | Billing contact, payment metadata (no full card data) | EU / US |
| Google Ireland Ltd | Calendar, mailbox, Business Profile and website analytics | Calendar events, mailbox content where connected, usage events | EU / US |
| Microsoft Ireland Operations Ltd | Outlook / Microsoft 365 mailbox and calendar integration | Mailbox and calendar content where connected | EU / US |
| Amazon Web Services EMEA SARL | Object storage for media, attachments and exports | Files, images, recordings and generated exports | EU |
| MongoDB Ltd | Primary application database | All platform records, including conversation content | EU |
| Pinecone Systems Inc. | Vector index for knowledge retrieval | Embeddings derived from customer knowledge content | US / EU |
| Cloudinary Ltd | Image and media transformation and delivery | Images and media supplied by the customer | EU / US |
| Cloudflare Inc. | CDN, DNS and DDoS protection for the website | IP address, request metadata | Global edge |
Hosting and infrastructure providers used to run the platform are held in the EU. The complete current list, including infrastructure providers and their regions, is available for vendor security reviews on request at [email protected].
3. Contractual safeguards and transfers
Each sub-processor is bound by a written agreement imposing data-protection obligations no less protective than those in our own DPA, including confidentiality, security measures and assistance duties.
Where a sub-processor processes data outside the EU/EEA we rely on an adequacy decision or on Standard Contractual Clauses with supplementary measures where required. Details are available on request.
4. Changes and right to object
We keep this page current. Customers who have asked to be notified receive at least 30 days' notice before a new sub-processor starts processing their data, or as soon as practicable where a change is urgent for security or continuity.
A customer may object to a new sub-processor on reasonable data-protection grounds within that notice period. If we cannot offer a workable alternative, the customer may terminate the affected part of the service. To subscribe to notifications, write to [email protected].
