This page lists the third-party sub-processors that DA592 LTD, trading as Masheev engages to process Customer Data on behalf of our customers in connection with the provision of the Services. This list is maintained in accordance with our Data Processing Addendum (DPA) and Privacy Policy.
We will provide at least thirty (30) days' prior written notice before adding or replacing a sub-processor. The notice will be sent to the email address associated with the Customer's account. Questions or objections may be sent to privacy@masheev.com.
Sub-Processors and Transfer Safeguards
These providers process only the data needed for the feature the customer uses. Retention is governed by the applicable provider terms, DPA, product, and Masheev configuration; this page does not promise zero retention. Masheev does not use Customer Data to train its own models and does not authorize providers to use Customer Data for model training where provider contracts or settings offer that control.
The last column shows the safeguard Masheev relies on for transfers from the UK. We checked each certification shown below on the official Data Privacy Framework List on 5 November 2026. Where a provider is not certified, we rely on the UK Addendum to the Standard Contractual Clauses in that provider's data processing terms.
| Sub-Processor | Purpose | Data Location | Transfer safeguard (from the UK) |
|---|---|---|---|
| Cloudflare, Inc. | Workers hosting, CDN and DDoS protection, R2 file storage, Durable Objects, queues, workflows, inbound email routing and outbound email sending, Workers AI (embeddings, reranking, classification), Browser Rendering (web page extraction), Vectorize (single global knowledge index), Turnstile (bot checks) | Global edge; regional R2 per organization region; global queues, workflows and knowledge index | UK Extension to the EU-U.S. Data Privacy Framework; UK Addendum in Cloudflare's DPA |
| PlanetScale, Inc. | Managed PostgreSQL database and backups | EU (Frankfurt) and US (Northern Virginia), per organization region | UK Extension to the EU-U.S. Data Privacy Framework |
| Functional Software, Inc. (Sentry) | Error and performance monitoring, configured to exclude message content | United States | UK Extension to the EU-U.S. Data Privacy Framework |
| Railway Corp. | Hosting for the self-managed billing service | United States | UK Extension to the EU-U.S. Data Privacy Framework |
| Anthropic, PBC | AI responses, summaries, classification | United States | UK Addendum to the SCCs (Anthropic DPA) |
| OpenAI, L.L.C. | AI responses and text generation; text-to-speech | United States | UK Addendum to the SCCs (OpenAI DPA) |
| Google LLC (Gemini API) | AI responses, only where Masheev has approved the use | United States / Global | UK Extension to the EU-U.S. Data Privacy Framework |
| ElevenLabs, Inc. | Voice AI processing for calls, including speech-to-text, text-to-speech, conversation handling, and deletion of synthetic voices created before voice cloning was switched off. Call transcripts, and call audio where the customer enables call audio retention, are kept by ElevenLabs for up to 30 days. For outbound calls, which we enable only by agreement, call audio is always kept for 30 days and every call opens with a recording notice | United States | UK Extension to the EU-U.S. Data Privacy Framework; UK Addendum in ElevenLabs' DPA |
| SpaceX Super Intelligence LLC (xAI) | Grok voice agents (speech-to-text, conversation handling, text-to-speech) and Grok language models, only where the Customer chooses Grok for an agent. Customer Data is sent to xAI only through its Zero Data Retention API, under which xAI does not keep request content after processing; Masheev does not use xAI until that setting is confirmed | United States | UK Addendum to the SCCs (xAI DPA) |
| Twilio Inc. | Phone numbers, SMS and RCS messaging, voice call connection and delivery status | United States / Global | UK Extension to the EU-U.S. Data Privacy Framework; UK Addendum in Twilio's DPA |
| Jina AI GmbH | Fetching and extracting web pages for knowledge ingestion and when an AI agent looks up a web page, and web search for a business's public contact details (only the business domain is sent) | EU / provider infrastructure | EU adequacy (UK regulations recognise the EEA) |
| TablePort Ltd. | Customer-enabled reservation workflows | United Kingdom | Not a restricted transfer |
| Resend, Inc. | Legacy email delivery records only; no new sending | United States | UK Extension to the EU-U.S. Data Privacy Framework (re-certification under review) |
Services you connect. Channel and integration providers process data only when the corresponding channel or integration is enabled. When you connect your own Google, Microsoft, Meta (WhatsApp, Instagram) or Apple account, we exchange data with that provider on your instructions. For WhatsApp Business messaging Meta acts as our processor or yours under Meta's business terms; for Instagram, Google and Microsoft accounts, the provider also processes data under its own terms with you as its customer. When you connect Notion or Atlassian (Confluence and Jira), we read the pages you choose to sync and, if you turn on Jira, create and follow the issues your team files from conversations. Notion Labs, Inc. and Atlassian process that data under their own terms with you as their customer; they are not Masheev sub-processors. If a user connects an AI assistant such as ChatGPT, Claude or Grok to Masheev (through our MCP server, API or command-line tool), that assistant receives the data its requests return, on that user's instruction and under that user's own agreement with the assistant's provider. Those providers are not Masheev sub-processors. These providers are listed here so you know where data goes.
AI providers and their usage policies. Customers must follow the usage policies of the AI providers above (Acceptable Use Policy Section 5.4):
| AI provider | What it does in Masheev | Usage policy |
|---|---|---|
| Anthropic, PBC | AI responses, summaries, classification | Anthropic Usage Policy |
| OpenAI, L.L.C. | AI responses, text generation, text-to-speech | OpenAI Usage Policies |
| Google LLC | Gemini AI responses, only where Masheev has approved the use | Generative AI Prohibited Use Policy |
| ElevenLabs, Inc. | Voice agents, speech-to-text, text-to-speech | ElevenLabs Prohibited Use Policy. Callers must be told they are speaking with AI and that calls are recorded and may be shared with ElevenLabs and its AI model providers. |
| SpaceX Super Intelligence LLC (xAI) | Grok voice agents and language models, where the Customer chooses Grok | xAI Acceptable Use Policy |
Not currently in use: Perplexity AI is not in use. We will give 30 days' notice before using it.
Masheev may also retrieve public company information from Companies House. Companies House is a public data source, not a Masheev sub-processor.
Providers We Use for Our Own Purposes
These providers do not receive Customer Data you upload or End-User communications. They process data for which Masheev is the controller, as described in our Privacy Policy. They are listed here for transparency.
| Provider | Purpose | Data Location | Transfer safeguard (from the UK) |
|---|---|---|---|
| 650 Industries, Inc. (Expo) | Delivers push notifications to the Masheev mobile app through Apple and Google, and delivers app updates. Receives device push tokens and notification routing identifiers; notification text is generic and never contains message content | United States | UK Extension to the EU-U.S. Data Privacy Framework |
| Treg (not in use) | Business data enrichment during workspace setup. Not in use; we will update this page before we use it | To be confirmed | To be confirmed before use |
Billing and Payment Sub-Processors
| Sub-Processor | Purpose | Data Location | Transfer safeguard (from the UK) |
|---|---|---|---|
| Stripe | Payment processing, subscription billing, and invoice management | United States | UK Extension to the EU-U.S. Data Privacy Framework (Stripe, LLC) |
The billing engine is self-hosted Lago software on Railway. Merely supplying that software does not give Lago Labs access to Customer Data; Railway is listed as its hosting processor. Any separately authorized vendor support access must be assessed and disclosed before use.
Changes to This List
We will update this page when sub-processors are added, removed, or replaced. Material changes will be communicated to customers via email notification at least thirty (30) days before the new sub-processor begins processing Customer Data.
If you have questions or objections regarding a sub-processor change, please contact us at privacy@masheev.com within thirty (30) days of receiving the notification. If we cannot resolve a reasonable objection, you may end the affected services without penalty and we will refund prepaid fees for them, as set out in Section 8.4 of the DPA.