Subprocessors

Last updated: October 2026

In accordance with GDPR Art. 28.2, this page lists every third-party that processes personal data on behalf of MailMCP customers. We update this list when subprocessors change. To be notified of changes, email privacy@mailmcp.io.

1. Infrastructure & hosting

Subprocessor	Purpose	Location	Coverage
LWS Ligne Web Services SAS	Web hosting, database, file storage, and support email (IMAP/SMTP).	🇫🇷 France Datacenters in France	ISO 27001 · HDS · GDPR-native DPA

2. AI inference (OpenRouter routing)

AI calls go through OpenRouter, configured so that providers neither retain nor train on our data. Every feature that handles customer personal data is pinned to an EU region, with no fallback to another region. The public website chat is the exception: it runs on a model hosted outside the EU, under Standard Contractual Clauses. MailMCP never sends the content of your mailboxes to an AI: only the AI assistant you connect yourself (Claude, ChatGPT…) reads it.

Subprocessor	Purpose	Location	Coverage
OpenRouter OpenRouter, Inc.	AI gateway. Routes our calls to the providers below. Does not retain prompts or responses.	🇺🇸 USA Gateway only (no storage)	SCCs · Zero retention Privacy
AI providers (EU or US) Support only	Sorting and drafting replies to the messages you send to our support, as data controller (see our privacy policy). Personal data (emails, phone numbers, IBAN…) is masked before sending.	🇪🇺 European Union 🇺🇸 USA	DPF / SCCs · Zero retention
Microsoft Azure OpenAI GPT-4o-mini	Email signature generator, outreach pitch generation.	🇸🇪 Sweden Sweden Central	ISO 27001 · SOC 2 · GDPR DPA
Microsoft Azure OpenAI GPT-5.4-mini	Public website chat (Léa): only what the visitor types in the chat.	Outside the EU Hosting region not guaranteed by the provider	SCCs · Zero retention DPA
OpenAI text-embedding-3-small	Documentation search for the public chat: the visitor question is converted into a vector to find the relevant help pages.	🇺🇸 USA OpenAI, L.L.C.	SCCs DPA

Explicitly NOT used: No provider based in China (DeepSeek, Moonshot, Qwen…) receives customer data.

3. Payment

Payments are handled by our Merchant of Record:

Subprocessor	Purpose	Location	Coverage
Polar Polar Software, Inc.	Card payments, recurring billing, invoicing (Merchant of Record). We never see or store card numbers.	🇺🇸 United States Merchant of Record — collects and remits VAT on our behalf	SCC · GDPR DPA

4. What we do NOT use

No analytics tracker (no Google Analytics, no Plausible, no Matomo on the public site).
No advertising network, no behavioral tracking, no cookie consent banner needed (only strictly necessary cookies).
No US hosting (MailMCP servers and database are in France, at LWS).
No AI training on your data. Our AI providers are configured, or contractually bound, not to use our calls for training.

Need a signed DPA? →