1. Current subprocessors
MivoChat uses the following subprocessors. Each one is bound by a data processing agreement and processes personal data only on our documented instructions. This list applies both to our own account data and to visitor data processed for customers under the Data Processing Agreement.
| Provider | Purpose | Location | When it is involved |
|---|---|---|---|
| Supabase | Database, sign-in (authentication), file storage for chat image uploads, and rate-limit counters. | EU (Frankfurt, eu-central). Supabase is headquartered in the United States. | Always |
| Vercel | Application hosting and serverless functions (pinned to fra1, Frankfurt), content delivery, and bot protection on public demo endpoints. | EU (fra1) for functions. Vercel is headquartered in the United States. | Always |
| Anthropic | Generates AI replies and translations from the visitor's message and your knowledge text (Claude API). | United States | Always, for every AI reply |
| Resend | Sends transactional email: sign-in links, security notices, and notifications to your team. | United States | Always |
| Telegram | Relays conversations to your team through the shared MivoChat bot or your own bot. Also used for MivoChat's internal operational alerts. | Outside the EU/EEA | When you connect Telegram, and for internal alerts |
| Slack (beta) | Relays conversations to your Slack channels when you connect Slack. Slack is in beta and available on request. | United States | Only when you connect Slack |
| Meta Platforms (WhatsApp Business Platform) | Delivers WhatsApp messages between your visitors and your team when you connect a WhatsApp Business number. | Global, primarily the United States. Meta Platforms is headquartered in the United States. | Only when you connect WhatsApp |
| Google sign-in, when enabled for your account, and Google Calendar connection for booking requests on Starter and Pro plans. | United States and other locations | Only when you use Google sign-in or connect Google Calendar | |
| Stripe | Payment and subscription processing for paid plans. | United States | Not yet active. Paid billing is not enabled. It will be used once billing launches. |
2. Changes to this list
We update this page when we add or remove a subprocessor. Customers receive advance notice of a new subprocessor and may object to it, as set out in section 6 of the Data Processing Agreement.
3. Transfers outside the EEA
Where a subprocessor processes data outside the EEA, we rely on appropriate safeguards under Chapter V GDPR, such as the EU Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework. To ask for a copy of the safeguards for a specific provider, email hello@mivochat.app.