Sub-processors
Last updated: October 20, 2026 · English is the binding version.
These are the third parties that may process personal data on your behalf when you use Monfri, under our Data Processing Agreement. We give at least 30 days' notice — by e-mail to workspace owners and on this page — before adding or replacing one (DPA §5).
Our servers, databases, analytics engines and e-mail delivery are our own infrastructure in a data centre in Sofia, Bulgaria; they are not sub-processors. Stripe is not on this list: it is the merchant of record for payments and acts as an independent controller.
Infrastructure
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | CDN, DDoS protection, DNS and web application firewall in front of every service | Request metadata: IP address, headers, user agent | Global network; SCC |
| Cloudflare, Inc. (R2) | Encrypted off-site backups; storage of uploaded files | Stored data — backups encrypted with a key we hold offline | Cloudflare network; SCC |
AI
| Sub-processor | Where it is used | What is sent | Location |
|---|---|---|---|
| OpenAI | CRM | Records indexed for AI search and assistance; a thread or draft when you use AI on it | United States; SCC. Not used to train models. |
| Assistant | Each message and the conversation so far, the visitor's name, up to six CDP attributes, the results of the bot's tools | ||
| Pages | Text you ask AI to write or work on; page text indexed for AI search | ||
| CDP | Article text for enrichment; a profile's attributes and recent events when you ask for a summary | ||
| Automation | Whatever a flow passes to an AI step | ||
| Agents | Names, companies and deals from CRM and aggregated CDP data; e-mail text only where the workspace and the mailbox owner allowed it |
Other services
| Sub-processor | Purpose | Data |
|---|---|---|
| Kickbox | CRM workflows: disposable-domain check when validating an e-mail address | The e-mail domain only |
| Nominatim / OpenStreetMap Foundation | CRM workflows: geocoding an address | Postal address |
| Google Fonts, placehold.co | Fonts and placeholder images in some Push e-mail templates, loaded when a recipient opens the message (being removed) | The recipient's IP address and user agent |
Services you connect yourself
These are not our sub-processors. You choose them, you contract with them, and you are responsible for what you send to them:
- your own mail servers (IMAP/SMTP), Microsoft and Google calendars;
- your Firebase (FCM) project and Apple (APNs) key for mobile push;
- the connectors you add in Automation, including search providers that use your own key;
- the CDP destinations you enable — ad audiences on Meta and Google (sent only for people who gave explicit marketing consent), Klaviyo, Mailchimp, SendGrid, BigQuery, Snowflake and webhooks;
- your shop platform (WooCommerce, Shopify, CloudCart, Magento, OpenCart) and the "Monfri" WordPress plugin;
- your Telegram bot for the Assistant, and the Slack channels you choose for Agents' reports.
Web push is delivered by the push service of the subscriber's browser (Google, Mozilla, Apple or Microsoft); neither you nor we choose it.