mDOS Sub-Processor List

MDOS AI LTD (“we”, “us”) operates the mDOS Master Digital Operating System & AI Growth Engine as a Data Processor on behalf of our clients (Data Controllers). To deliver the platform, we engage certain third-party service providers (“Sub-Processors”) who may process personal data on our behalf.

This page is the single authoritative list of every Sub-Processor we currently engage, their purpose, data location, and applicable transfer basis. It forms part of our Data Processing Agreement and is kept up to date in accordance with our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. What Is a Sub-Processor?

A Sub-Processor is a third party that we engage to process personal data on your behalf as part of delivering the mDOS platform. This is distinct from independent data controllers (such as payment networks that set their own terms) and from vendors who process only operational metadata that does not constitute personal data (such as source-code repositories).

We impose data protection obligations on all Sub-Processors equivalent to those owed to you under our DPA, including appropriate technical and organisational security measures and restrictions on further sub-processing. Where an agreement is still being put in place, the Transfer Basis column below says so in plain words rather than implying a completed one — read that column, not this paragraph, for the status of any individual Sub-Processor.

2. Current Sub-Processors

The following Sub-Processors are currently engaged by MDOS AI LTD in connection with the mDOS platform.

Infrastructure & Hosting

Sub-Processor	Purpose	Processing Location	Transfer Basis
Supabase (hosted on AWS eu-west-2)	PostgreSQL database (all platform data), authentication (user sessions and identity), and object storage. Primary datastore for all personal data processed through the platform.	UK (AWS London)	SOC 2 Type II; UK domestic (no transfer outside UK)
Railway	Containerised application hosting (staging and production runtimes). All application data transits and resides on Railway infrastructure during processing.	UK (AWS London)	SOC 2 Type II; UK domestic (no transfer outside UK)
Cloudflare / Cloudflare R2	Content Delivery Network, Web Application Firewall, DDoS protection, SSL/TLS termination, edge proxy routing, domain DNS, and object storage for all client-uploaded media, documents, and site assets. All uploads are stored under a per-client path prefix.	UK edge / EU	SOC 2 Type II + ISO 27001; EU adequacy / UK IDTA

Payments

Sub-Processor	Purpose	Processing Location	Transfer Basis
Stripe	Payment processing via Stripe Connect. Processes cardholder data, connected account identity, and payout information on behalf of business operators. Stripe acts as an independent data controller for its own compliance obligations and as our sub-processor for platform-initiated payment flows.	EU entity (card data global)	PCI DSS Level 1 + SOC 2 Type II; EU adequacy

Communications

Sub-Processor	Purpose	Processing Location	Transfer Basis
Resend	Transactional and marketing email delivery. Processes recipient email addresses, names, and email content for all platform-triggered customer communications (order and appointment confirmations, CRM campaigns, system notifications).	US	SOC 2 Type II; UK IDTA
Twilio	SMS and WhatsApp messaging. Processes recipient mobile phone numbers and message content for platform-triggered SMS customer communications (OTP codes, customer notifications, marketing messages where enabled).	US	UK IDTA

Background Processing & Jobs

Sub-Processor	Purpose	Processing Location	Transfer Basis
Trigger.dev	Background task processing and workflow orchestration. Processes personal data in transit during scheduled jobs including campaign delivery, bulk data exports, CRM sync operations, and review response generation.	US	SOC 2 Type II in progress; UK IDTA
Upstash	Redis-based rate limiting and short-lived caching. May temporarily cache session identifiers and rate-limit keys derived from authenticated user context. No persistent personal data stored.	EU	SOC 2 Type II; EU adequacy

Channel Management

Sub-Processor	Purpose	Processing Location	Transfer Basis
Channex	OTA channel manager integration for accommodation venues. Processes guest reservation data (name, dates, room type, booking source) for synchronisation with OTA channels (Booking.com, Expedia, etc.). Only active for venues with the Hotel PMS module enabled.	UK / EU	DPA being finalised

Artificial Intelligence

Sub-Processor	Purpose	Processing Location	Transfer Basis
Google (Gemini AI)	Sentiment analysis, reporting narratives, voice synthesis, and content drafting. Google processes data in transit only under their Enterprise API terms, which prohibit use of API data for model training. Clients can disable AI features per account.	US / EU	Enterprise Data Terms; No model training; UK IDTA / EU SCCs
OpenAI (ChatGPT API)	Multi-channel copywriting, campaign structuring, and B2B outreach drafting. Processed in transit only under Enterprise API terms, which prohibit use of API data for model training. Clients can disable AI features per account.	US / EU	Enterprise API Terms; No model training; UK IDTA
Anthropic (Claude API)	Long-context document analysis, strategy synthesising, and brand-voice auditing. Processed in transit only under Enterprise API terms, which prohibit use of API data for model training. Clients can disable AI features per account.	US	Enterprise API Terms; No model training; UK IDTA

Prospecting, Enrichment & SEO Data

These providers are used only by the features that need them (SEO link-building outreach, Digital PR media contacts, Website Intent account enrichment and SEO analysis), and only where the provider is configured. They receive the website domain, company name, URL or keyword being looked up — not your customer records. Apollo.io and Hunter.io return publicly available business contact data (name, business email address, job title, LinkedIn profile URL) and company data from their own databases.

Sub-Processor	Purpose	Processing Location	Transfer Basis
Apollo.io	B2B contact discovery for a website domain (name, business email, job title, LinkedIn profile URL) for SEO link-building and Digital PR outreach, and — only where a client has separately opted in to paid enrichment — company industry and headcount for Website Intent accounts, looked up by the company’s domain. Personal email addresses and telephone numbers are never requested.	See provider	Provider’s terms — contact us for the current transfer mechanism
Hunter.io	B2B contact discovery for a website domain (name, business email, job title, LinkedIn profile URL) for SEO link-building and Digital PR outreach.	See provider	Provider’s terms — contact us for the current transfer mechanism
DataForSEO	SEO data: search rankings, keyword research, backlink data, website crawls and AI-search visibility for the domains, URLs and keywords a client specifies. Processes public web and search data; customer contact records are not sent.	See provider	Provider’s terms — contact us for the current transfer mechanism

Website Intent (B2B visitor identification) resolves a visitor’s IP address to an organisation using reference data held inside the platform; no visitor IP address is sent to a third-party lookup service, and the platform’s paid IP-lookup tier is disabled for every account. Company industry and size are looked up by the organisation’s domain or name from UK Companies House, a public register, and — where a client opts in — Apollo.io (above). Where a client switches on company logos, the organisation’s domain (never a person’s data) is sent to Google’s favicon service.

Calendar & Scheduling Integrations

Sub-Processor	Purpose	Processing Location	Transfer Basis
Google (Calendar API)	Two-way synchronisation of bookings with Google Calendar for businesses that enable this integration. Processes event titles, attendee details, and dates. Only activated when a user explicitly connects their Google Calendar (opt-in).	US and EU	Google Workspace DPA; UK IDTA / EU SCCs
Microsoft (Graph API)	Two-way synchronisation of bookings with Microsoft Outlook / Exchange for businesses that enable this integration. Processes event titles, attendee details, and dates. Only activated when a user explicitly connects their Microsoft account (opt-in).	US and EU	Microsoft Online Services DPA; UK IDTA / EU SCCs

Monitoring & Observability

Sub-Processor	Purpose	Processing Location	Transfer Basis
Sentry	Application error tracking and performance monitoring. Captures stack traces and request context. We configure Sentry to scrub PII from error payloads; email addresses are automatically redacted. No personal data is intentionally sent to Sentry.	US	SOC 2 Type II; UK IDTA
PostHog	Product analytics for the mDOS website and the Platform, loaded only after the visitor or user has given analytics consent. Captures page views and feature interactions (with access tokens removed from URLs) and, where enabled, session recordings with all form inputs masked. IP address capture is disabled. Signed-in users are identified by their internal user ID, role and a one-way hash of their email address; no plain-text email address is sent. Visitors are otherwise pseudonymised using a random device identifier.	EU (PostHog EU Cloud)	SOC 2 Type II; EU adequacy

Advertising & Conversion Measurement

The platform operates first-party, server-side conversion relays. These run only when a client has connected their own advertising account, and only for visitors who have granted advertising consent — the relay is fail-closed on consent, so an unconsented page view sends nothing. Email and phone number are SHA-256 hashed before transmission in every case.

Sub-Processor	Purpose	Processing Location	Transfer Basis
Meta Platforms (Conversions API)	Server-side conversion measurement for the client’s own Meta pixel. Receives SHA-256 hashed email and phone number, plus IP address, User-Agent and Meta click identifiers (_fbc, _fbp), which are transmitted unhashed as the API requires.	US / global	Client-connected account — sent under the client’s own credentials, governed by the client’s agreement with the network and the network’s published controller/processor terms.
Google Ads (Enhanced Conversions)	Server-side conversion measurement for the client’s own Google Ads account. Receives SHA-256 hashed user identifiers and, where present, the Google click identifier.	US / global	Client-connected account — as above.
LinkedIn (Conversions API)	Server-side conversion measurement for the client’s own LinkedIn ad account. Receives SHA-256 hashed email and phone number, plus the LinkedIn click identifier (li_fat_id).	US / global	Client-connected account — as above.
OpenAI (ChatGPT Ads Conversions API)	Server-side conversion measurement for the client’s own OpenAI Ads pixel. Receives SHA-256 hashed email and phone number, plus IP address, User-Agent and the OpenAI browser/click references (obref, oppref), which are transmitted unhashed as the API requires.	US / global	Client-connected account — as above.
Google Analytics 4 (Measurement Protocol)	Server-side event measurement into the client’s own GA4 property. Receives a pseudonymous client identifier and, where available, a SHA-256 hashed email as user_data.	US / global	Client-connected account — as above.

Note: Doppler, Uptime Kuma, and GitHub are operational sub-processors that handle only configuration, secrets, or synthetic monitoring data. They do not process customer personal data and are therefore not listed above.

3. International Transfers

Several Sub-Processors are headquartered in the United States or operate global infrastructure. Where personal data is transferred outside the United Kingdom or European Economic Area, we ensure an adequate transfer mechanism is in place, which will be one or more of:

• UK Adequacy Regulations — where the destination country has an adequacy decision under UK GDPR.
• International Data Transfer Agreement (IDTA) — the UK-specific standard contractual clauses approved by the ICO.
• UK Addendum to the EU Standard Contractual Clauses — the EU Commission’s approved clauses, adopted for UK transfers under the UK Addendum.
• Sub-Processor’s own Data Processing Agreement — where the Sub-Processor publishes a DPA that satisfies the applicable transfer requirements (e.g. Stripe, Google, Microsoft).

Transfer mechanisms for each Sub-Processor are noted in the table above. For further information on any specific transfer, please contact us using the details in Section 5.

4. Changes to This List

We will provide at least 30 days’ prior written notice before adding or replacing a Sub-Processor that will process your personal data. Notice will be given by email to the address registered on your account, or by updating this page with a changelog entry.

If you object to a new or replacement Sub-Processor within the 30-day notice period, and we are unable to accommodate your concern without the Sub-Processor, you may terminate your Subscription without penalty in accordance with the Data Processing Agreement.

Minor changes — such as a Sub-Processor changing their registered legal entity name or updating their own DPA — do not constitute a material change and will be reflected on this page without prior notice.

5. Contact

If you have questions about this Sub-Processor list, our data processing practices, or wish to exercise your rights under UK GDPR, please contact:

MDOS AI LTD
Data Controller & Processor
Company No. 17526969
Brighton, UK
privacy@mr-digital.co.uk

To submit a formal data subject access request, exercise your right to erasure, or raise a concern about our data processing, please email the address above with the subject line “Data Request — mDOS”.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.