Sub-processors
Mallah Software Services Private Limited does not run MADBOT on its own machines end to end. Other companies host it, store its data, run the model and deliver its email. Where those companies handle personal data on our behalf, they are sub-processors, and you are entitled to know who they are before you trust us with anything.
This is the full list as at the last-updated date above.
What a sub-processor is
When you use MADBOT for your own business, you are usually the controller of the personal data involved and we are your processor. A sub-processor is a company we engage to carry out part of that processing for us. Our hosting provider is one. The model provider that reads your site content is another.
This matters because a processor may not bring in a sub-processor without the controller's authorisation. By accepting the Terms of Service and the Data Processing Addendum, you give general written authorisation for the companies below, on the conditions set out in this page.
The current list
| Sub-processor | What it does | Where it processes | When it applies |
|---|---|---|---|
| Google (Firebase Authentication) | Account sign-in and identity. Holds your email address, sign-in provider and authentication tokens. | United States and globally | Always |
| Google (Cloud Firestore) | The database. Holds account records, connected sites, crawl and audit results, drafted content, lead records and usage counters. | The Firestore region chosen when the database was created | Always |
| Vercel | Hosting, edge routing, TLS termination and the approximate-country header used to pick a currency. | United States, and edge locations globally | Always |
| Anthropic (Claude API) | Analysing site content and generating copy: audits, articles, social drafts, listing copy, lead qualification and AI visibility checks. | United States | Always |
| Resend | Transactional email, the welcome message, weekly digests, and the delivery events behind bounce and complaint handling. | United States and the European Union | Always |
| GitHub | Receiving generated articles as pull requests on your repository. | United States | Only if you connect a repository |
| Google Search Console API | Reading your own search performance data for the property you verified. | United States and globally | Only if you connect it |
| LinkedIn, X, Meta | Publishing social posts you have approved on screen, to the account you connected. | United States and globally | Only if you connect that account |
Where a row says the processing happens globally, that reflects the provider's own network. Edge routing and content delivery in particular can touch a location close to the person making the request, rather than the region where data is stored.
The ones that only apply sometimes
Five of the entries above run for every account. The rest only ever see anything if you switch the relevant feature on:
- GitHub receives nothing until you connect a repository. It then receives the article text and the branch and commit metadata that a pull request needs.
- Google Search Console is read-only, is limited to the property you verified, and is only called after you connect it.
- LinkedIn, X and Meta receive a post only after you approve that specific post on screen. Nothing is published automatically.
Disconnecting an integration stops any further processing by that provider. It does not, on its own, delete what they already received, because a merged pull request or a published post belongs to that platform after it lands there.
How each one is bound
Each company above is engaged under its own data processing terms, which impose obligations at least as protective as those we owe you under our Data Processing Addendum. In practice that means confidentiality, security measures appropriate to the risk, restrictions on further sub-processing, and deletion or return at the end of the relationship.
We remain responsible to you for what they do. If a sub-processor fails to meet its obligations, our liability to you is unchanged by the fact that the failure happened at their end.
The model provider is engaged on terms under which content sent to the API is not used to train its models. If that ever changes we will treat it as a material change to this list and give notice under the section below.
Where the data goes
Mallah Software Services Private Limited is incorporated in India, and several of the companies above process in the United States. If you are in the European Economic Area, the United Kingdom or another jurisdiction with transfer restrictions, that means your data leaves it.
Those transfers rely on the Standard Contractual Clauses incorporated into each provider's data processing terms, with the UK International Data Transfer Addendum where the transfer is from the United Kingdom. The Data Processing Addendum sets out the mechanism in full, and the Privacy Policy explains what we hold and for how long.
Adding or replacing a sub-processor
We will give at least 30 days' notice before a new sub-processor starts processing personal data, or before an existing one is replaced. During that period you may object in writing, on reasonable grounds related to data protection.
If you object, we will try to offer a change to the service or a different arrangement that avoids the processing you objected to. If we cannot do that within a reasonable time, you may terminate the affected part of the subscription without penalty, and we will refund any fees covering the period after termination.
One exception. Where a provider has to be replaced urgently, for security or continuity reasons, we may act first and notify you as soon as we can. The right to object still applies afterwards.
Being told about changes
This page is the authoritative list, and the last-updated date at the top of it changes whenever the list does. If you would like changes pushed to you rather than having to check, write to support@getmadbot.com and ask to be added to the sub-processor notification list. Tell us which address should receive it. There is no charge for this and no minimum plan.
Questions about a specific provider, or a request for a copy of the relevant terms, go to the same address.