Subprocessors
This page lists the third parties that 98M7 Group OÜ engages to process personal data on behalf of our customers in connection with the Services. It is incorporated by reference into our Data Processing Agreement. We give at least 30 days' notice before adding or replacing a subprocessor (by updating this page and, for customers who have opted in to subprocessor change notifications, by email).
Current subprocessors
| Subprocessor | Purpose | Data categories | Hosting location | Country of incorporation | Transfer mechanism |
|---|---|---|---|---|---|
| Cloudflare, Inc. | Hosting, edge compute (Workers), static asset delivery (Pages), database (D1), object storage (R2), DNS, CDN, DDoS protection, WAF | All Customer Personal Data processed by the Services, in transit and at rest | Global edge network; primary data residency in EU regions where configured | United States | EU-US Data Privacy Framework (Cloudflare is DPF-certified); EU SCCs Module 2/3 as fallback |
| Stripe Payments Europe, Ltd. (with Stripe, Inc.) | Payment processing, billing, fraud prevention, invoicing | Name, billing address, email, payment card details (full PAN never reaches 98M7), transaction history, VAT number, IP address | EU and US | Ireland (Stripe Payments Europe) and United States (Stripe, Inc.) | Intra-EU for Stripe Payments Europe; EU-US Data Privacy Framework and EU SCCs for Stripe, Inc. |
| Anthropic, PBC | AI inference for AI-powered features (where used by the relevant Service) | Prompts, conversation context, system instructions (Customer Content as submitted to AI features). Anthropic does not train models on Commercial API inputs. | United States | United States | EU-US Data Privacy Framework (Anthropic is DPF-certified); EU SCCs Module 3 (Processor-to-Processor) as fallback |
| OpenAI, OpCo, LLC (with OpenAI Ireland Ltd.) | AI inference for AI-powered features (where used by the relevant Service) | Prompts, conversation context (Customer Content as submitted to AI features). OpenAI does not train models on API inputs by default. | United States (and EU residency for eligible customers) | United States; Ireland for EU contracting entity | EU-US Data Privacy Framework; EU SCCs Module 3 as fallback |
| Resend, Inc. | Transactional email (sign-up, password reset, billing receipts, in-app notifications) | Recipient email address, email subject and body, sending metadata | United States and EU edge | United States | EU-US Data Privacy Framework; EU SCCs Module 3 as fallback |
Affiliates
We do not currently use group affiliates as subprocessors. If we do in future, they will be listed above with the same disclosures.
Subscribe to changes
To be notified by email of additions or replacements to this list, contact us through the contact page with subject "Subprocessor notifications". This is a one-line subscription; you can unsubscribe at any time.
Objections
If you object to a proposed subprocessor change on reasonable data-protection grounds, tell us during the 30-day notice period. If we cannot resolve the objection, you may terminate the affected Service and receive a refund of unused prepaid credits for that Service.
Contact
98M7 Group OÜ — Tallinn, Estonia. Contact us.