Subprocessors
Checked against the code: 6 October 2026
Every third party that processes data for us, what it does, what it can see and where it runs. The list is compiled from the code rather than from memory, so a call added to a new provider and a row added here are the same change. The policy this supports is the privacy policy.
| Processor | What it does for us | What it can see | Where it processes |
|---|---|---|---|
| Stripe | Card payments, subscriptions and prepaid credit top-ups. | Your email, the amount and the subscription state. Card numbers go to Stripe directly and never reach us. | Europe and the United States |
| Resend | Transactional email: magic-link verification and sign-in links, the code for adding an email address in our apps, contact-form delivery, billing alerts, quota threshold alerts, and alerts to our own team about unusual voice use in our apps. | The recipient address, the subject and the body of that one message. A voice-use alert goes to our own team and names a key only by the first few characters of its id. | United States |
| Supabase | The database behind our own sales CRM, which records contact-form enquiries and support tickets. | The name, email address, message, products selected and first-touch attribution you submit on the contact form. | Stated on request for a review |
| OpenAI | The voice Copilot demo only: it mints the realtime session and renders guidance phrases to speech. | What you say into the Copilot demo while it is running, and the guidance sentences it speaks back. Nothing else on the site or the API touches it. | United States |
| ElevenLabs | Recorded voices for older app versions and API callers who ask for one of its voices: when such a request needs a sentence we have never recorded in that voice, it records it, and we then keep and serve the recording ourselves. The current MapMap Nav and Tellway voices are recorded by an open-source voice model on our own servers at Hetzner, not by ElevenLabs. | The words of that one sentence and the voice to speak it in. The request comes from our servers, so it carries no key, account, position or IP address of yours. | Stated on request for a review |
| analytics.unified.studio | The Plausible analytics instance that serves our website analytics script and receives its events. | Page views and the events named in the privacy policy. Cookieless, with no persistent identifier and nothing stored on your device. | Europe (served from Hetzner infrastructure) |
| PostHog | Cookieless product analytics, for example how many visitors complete signup. | The same page and event data, held in memory for the visit only. | European Union (eu.i.posthog.com) |
| Anthropic | Triage of map problem reports: a model reads each new report and drafts a short diagnosis for our map team. It also helps our team research and draft in our own sales CRM. | For a map report: its position, the kind of problem, its note and when it was made, with no key, account or contact detail. For the CRM: the business contact and company details our team holds there. | United States |
| Slack | Alerts to our own team: a billing problem on a paid account, and, when switched on, an account nearing its monthly allowance and unusual voice use in our apps. | The account's email address and the alert itself, such as the plan, the amount or the usage. A voice-use alert carries no email address and names a key only by the first few characters of its id. | United States |
| PayAI | The x402 facilitator: it verifies and settles a pay-per-call payment made through x402, for an API caller who pays that way. | The payment itself: the paying wallet address, the amount and the network. Nothing about anyone who does not pay with x402. | Stated on request for a review |
| OpenStreetMap Foundation (Nominatim) | The map page on this website only, as a fallback: when our own search cannot answer a search, or cannot name a spot you click, your browser asks the OpenStreetMap Foundation's public Nominatim service directly. Our apps and the hosted API never use it. | The text you typed or the spot you clicked, with your IP address and browser details, because the request comes from your browser. | United Kingdom organisation; servers in Europe |
| Hetzner | The servers the API gateway, its data and our own voice service run on; the separate storage server our nightly backups go to; and object storage for demo files. | Everything the hosted API handles, as the infrastructure under it, including the words of spoken directions our voice service records, and the backups of our database. | European Union |
| Vercel | Hosting for this website, its API routes and the signup proxy. It also runs our static map renderer, which draws the images the API's static map endpoint returns, including the route picture in our navigation apps, and the scheduled job that triages map problem reports. | Requests to this website, including the request metadata any host sees. For a static map from the API: the map's parameters, such as a route line and markers, sent by our servers, with no key, account or IP address of the person who asked; the image may be kept in its cache. | United States company, website served from its global edge |
| Sentry | Error and performance monitoring for this website. | A crash report carrying the page, the browser and the originating IP address. | United States |
Transfers, changes and self-hosting
Where a processor is outside the United Kingdom we rely on the transfer terms in that provider's own data processing agreement. Our own data processing agreement, with a United Kingdom international data transfer addendum, is being drafted; until it is published, ask us and we will send you the provider terms we rely on for your review.
This list is part of the privacy policy's promise to keep the processor list current. We will update this page before a new processor starts handling personal data for us, and we will tell an affected customer by email where their agreement requires it. If a change matters to you and you want notice in writing, say so and we will add you to that list.
Self-hosted deployments are outside this list entirely. A self-hosted MapMap stack reports nothing to us and sends nothing to any processor here; the operator of that deployment chooses its own.
The Copilot demo, specifically
The voice Copilot is the one public surface on this site that sends what you say to a model provider, and it only does so while you are using it. Apart from it, only the map-report triage and our own sales CRM use a model provider (Anthropic, above). Running the Copilot app on your own infrastructure still calls OpenAI unless you supply your own key and endpoint, so a self-hosted Copilot is not automatically an OpenAI-free one.
Related: the privacy policy, what we collect at the telemetry disclosure, and the imagery notice at /legal/roadside-imagery. A question from a data protection officer reaches a person at hello@mapmap.ai.