Skip to content
Legal

Subprocessors

Last updated: September 7, 2026

The third-party services that process personal information on behalf of Mslahtk and its clients, with where they run and what they do. This list is part of our Data Processing Agreement. We give at least 14 days’ notice before adding or replacing a subprocessor.

Infrastructure and Storage

Where the data physically lives.

  • Railway (United States, US West region): hosting of the application and the PostgreSQL database.
  • Google Cloud / Firebase (United States and other Google regions): login and session tokens, file storage for uploaded media, push notifications.
  • Cloudflare (United States): DNS, edge network, bot protection on public forms.

Communication

Channels that carry messages to and from customers.

  • Meta Platforms (United States): the WhatsApp Business Platform. Message content and phone numbers pass through Meta’s infrastructure under its Business Terms.
  • Brevo (France): transactional email such as verification codes, billing notices and support replies.
  • Apple and Google (United States): delivery of push notifications to the mobile app.

Artificial Intelligence

Models that generate replies and content.

  • Google Gemini API, paid tier (United States and other Google regions): generates AI assistant replies, content drafts and summaries. Prompts and outputs are not used to train Google’s models and are logged by Google only briefly for abuse prevention.
  • Anthropic (United States): AI tooling used by our operations team to run, monitor and support the platform. Data sent through its API is not used for training.

Billing and Tax

Only for our own subscriptions with clients.

  • PayPlus (Israel): card payments and card-on-file tokens. Card numbers never reach our servers.
  • SmartBee (Israel): issuing tax invoices and receipts.

Operations and Monitoring

Keeping the service healthy.

  • Sentry (United States): application error monitoring, configured without personal data by default.
  • Telegram: operational alerts to our team. Alerts carry no customer identifiers.

Our Own Prospecting

Used for Mslahtk’s own sales, never for client data.

  • Apify (Czech Republic): collection of public business listings from Google Maps and public social pages.

Changes to This List

We notify clients by email or in the dashboard at least 14 days before a new subprocessor starts processing their data. A client that objects on reasonable grounds may terminate the affected service before the change takes effect. Last reviewed on the date shown above.

Questions about a vendor, or need our vendor register for a procurement review? Write to [email protected].

Email UsContact Page