Sub-processors

Maplith uses the providers below to deliver the service. Each one receives some customer data. This list is Annex IV of the Data Processing Agreement (DPA). For each provider it states the purpose, the categories of data, where it processes them, and on what basis the data may leave the EU. The Processing and security description, section 6, says in detail what each provider receives for each feature.

SP-1. The list

A provider marked announced, from a date is inside its notice period. It is on the list so that the notice is public, and it receives nothing until that date. A provider marked not live receives nothing until it goes live.

SP-2. Notice before a change

SP-2.1 We tell you at least 30 days before any of these takes effect (DPA clause 7.7.2):

• we add or replace a sub-processor;
• we use a listed sub-processor for a purpose its row above does not state;
• a listed sub-processor processes in a new location or under a new transfer mechanism.

We also give the same notice before a change to the description that lengthens a retention period, adds a category of personal data or of data subjects, or adds a kind of record that survives the deletion of a workspace (DPA clause 6.3(d)).

SP-2.2 Notice is given on this page (the version and date change, and the changelog says what changed) and by email. The email goes to every owner and admin of an organisation, and to everyone on the notice list. It is on by default for owners and admins, new ones included, and each of them can switch it off, and on again, under Settings → Organisation → Legal.

SP-2.3 To join the notice list: email [email protected] with the subject "Sub-processor notice". Write again to leave it.

SP-2.4 To object: reply before the change takes effect, stating the data protection grounds for the objection. If we cannot resolve it before the change takes effect, you may terminate the affected services without penalty, and we delete or return your data as the DPA describes (DPA clause 7.7.2).

SP-2.5 Emergency replacement: where a provider must be replaced at short notice for security or continuity reasons — for example a provider ceasing operations or a security incident at a provider — we tell you as soon as possible, and in any case before the replacement starts processing your data. Your right to object and terminate is unchanged (DPA clause 7.7.3).

SP-2.6 What needs no notice. A change in the detail of what a listed provider receives for a purpose its row already states is recorded in the description's changelog. One example is a new feature that sends map metadata to the language-model provider.

SP-3. Planned, not yet processing

None at present.

SP-4. Independent third parties that are not sub-processors

• Google, Microsoft and GitHub (single sign-on) — only if a user chooses that sign-in. The identity provider receives the sign-in request under the user's own relationship with it, and returns the email address, name and its own user identifier to Maplith. It does not act on Maplith's instructions, so it is not a sub-processor. It is listed here for transparency. All three sign-in options are live.

SP-5. Providers Maplith uses for its own operations

These providers receive data for which Maplith is the controller in its own right. They never receive uploaded content or the map, so they are not sub-processors under the DPA. The privacy policy describes them.

• Slack (United States) — Maplith's internal operational notifications. Receives workspace identifiers, organisation names, the email address of a new sign-up with the campaign tags and referring site it arrived by (never Google's click identifier), the email address of a workspace's admin when its first map is built, connector and GitHub account names, and run and payment events, and the public GitHub user names in notices of public activity on Maplith Bridge. Maplith tries to mask personal data in these notifications before they are posted, except in the notice of a new sign-up or a first map, which shows those email addresses in full. Basis: Slack's data processing addendum with the standard contractual clauses.
• cvrapi.dk (Denmark) — company lookup when an owner or admin types a CVR number into the organisation profile. Receives the CVR number typed, and nothing else.
• Cal.com (United States) — booking a call with Maplith from maplith.com. Receives what a person enters when booking: name, email address, the chosen time and any note. Maplith reads back the bookings to count them. Basis, as the provider states it: the EU-U.S. Data Privacy Framework, and the standard contractual clauses where appropriate.
• Google Workspace (Ireland / United States) — Maplith's own mailbox, calendar and files. Receives the mail people send to Maplith's addresses and Maplith's replies, meetings in Maplith's calendar, and, where Maplith uses its mail-sorting agent, the invoices and receipts the agent files in a Drive folder. Provided by Google Cloud EMEA Limited (Ireland); Google may process the data in the United States and elsewhere. Basis: Google's Cloud Data Processing Addendum, with the standard contractual clauses or another transfer solution Google has adopted for transfers to its subprocessors outside the EU.
• PostHog (EU) (Germany / United States) — analytics on maplith.com, only for a visitor who has accepted them on the cookie banner, and never in the app. Receives the pages the visitor views, how they arrived (the referring site and campaign tags), which of the site's calls to action they use, and technical details of the visitor's browser and device (such as their type and version, language, time zone and screen size), against a random identifier kept in the visitor's browser. It is set to discard the visitor's IP address, after it may have derived an approximate location from it, and receives nothing from the app or from a customer's workspace. Provided by PostHog, Inc. (United States), which hosts the data in its EU cloud in Frankfurt, Germany, and states that it may process it in the United States and elsewhere. Basis: PostHog's data processing agreement, with the standard contractual clauses, and, as that agreement states, PostHog, Inc.'s participation in the EU-U.S. Data Privacy Framework.
• Anthropic, a sub-processor above, also answers a website visitor's question to the demo company on maplith.com; where Maplith uses its mail-sorting agent, reads mail sent to Maplith's own addresses to sort it; and, where Maplith reads its own mail and operational notifications into its own workspace in Maplith, reads them to describe Maplith's own recurring work. For all of these, Maplith is the controller.
• GitHub, a sub-processor above for the hosted agent, also hosts Maplith's own issue tracker, which holds the feature suggestions customers' agents file as feedback on the product. Maplith adds no identifier of the workspace, the agent key, the customer or a person to them, asks agents to describe the capability and never data, and tries to mask identifiers in their text. For that copy, Maplith is the controller.

SP-6. How this list stays true

The list is generated from the same source as the DPA. On every change to the code, an automated check compares the hosts the code calls with this list. A provider that receives customer data and is not on the list fails the check, and the change cannot be deployed.

SP-7. Changelog