← Privacy Policy

Subprocessors.

Last updated: 12 May 2026

A subprocessor is a third party Mapou engages to process personal data on our customers' behalf, under our instructions. We commit to 30 days' advance notice to workspace admins (via the email of record) before adding a new subprocessor to this list.

Enterprise customers can request a counter-signed Data Processing Agreement at enterprise@mapou.ai. Standard and Premium customers accept the DPA terms incorporated by reference in the Terms of Service.

Infrastructure

Vercel Inc. ↗USA (multi-region)
PurposeApplication hosting, edge delivery, build pipeline.DataAccount email, IP address, request metadata, all workspace data in transit.
Data Processing Agreement ↗
PurposeManaged Postgres database (primary data store).DataAll workspace data at rest, encrypted by Neon's storage layer.
Data Processing Agreement ↗

Billing

Stripe Inc. ↗USA + global processing regions
PurposePayment processing, subscription management, hosted Checkout, hosted Customer Portal, invoicing.DataBilling email, billing address, payment method (card data held by Stripe, never by Mapou), subscription state, invoice history.
Data Processing Agreement ↗

AI providers

PurposeClaude models for prompt analysis, narrative inference, dashboard generation.DataPrompt text, brand and category context, AI-generated answers.
Data Processing Agreement ↗
PurposeGPT models for prompt analysis and embedding.DataPrompt text, brand and category context, AI-generated answers.
Data Processing Agreement ↗
Google LLC ↗USA + global
PurposeGemini models for prompt analysis. Google OAuth for sign-in. Google Analytics 4 read for workspace-connected accounts.DataPrompt text, GA4 page-level metrics, OAuth profile (name, email, avatar).
Data Processing Agreement ↗
PurposeGrok models for prompt analysis with live search.DataPrompt text, brand context.
Data Processing Agreement ↗
PurposePerplexity models for quarterly research runs (opt-in; not part of the monthly default engine set).DataPrompt text, brand context.
Data Processing Agreement ↗

Authentication

Microsoft Corp ↗USA + global
PurposeMicrosoft Entra ID (Azure AD) OAuth sign-in for enterprise customers.DataOAuth profile (name, email).
Data Processing Agreement ↗

Communications

PurposeTransactional email delivery (signup notifications, conversion confirmations, weekly digests, deletion-pending warnings).DataRecipient email, message subject and body.
Data Processing Agreement ↗

Workspace-connected (opt-in)

PurposePublic post search via the Reddit Data API (read-only, brand-mention monitoring).DataPublic post content matching the workspace's brand and competitor search terms.
Data Processing Agreement ↗
PurposeMeta Ads (Facebook/Instagram) campaign insights for workspaces that connect their ad account.DataAd account ID, campaign metadata, last-90-day aggregate insights (no user-level data).
Data Processing Agreement ↗
Shopify Inc. ↗Canada + USA
PurposeProduct catalog read for workspaces that connect their Shopify store.DataProduct metadata (titles, handles, URLs, structured-data flags). Never customer or order data.
Data Processing Agreement ↗
PurposeEmail / SMS campaign + flow analytics for workspaces that connect their Klaviyo account.DataCampaign and flow metadata, aggregate performance metrics. Never subscriber PII.
Data Processing Agreement ↗
Privacy PolicySubprocessorsTerms of ServiceContact