Subprocessors
The providers that process customer personal information on our behalf, what they do, and where. Changes are emailed to workspace owners at least 30 days ahead where practicable.
| Provider | Function | Information processed | Location | Transfer safeguard | Retention and AI training |
|---|---|---|---|---|---|
| Hostinger International Ltd (Cyprus) | Hosting, database, file storage, backups and email delivery | All workspace records and uploaded files, account details, outgoing email | Hostinger data centre outside South Africa | Hosting agreement with data processing terms (POPIA s72(1)(a) and (b)) | Kept for the service. Backups expire within 30 days of deletion. |
| OpenAI, L.L.C. (United States) | AI features: reading receipts and documents, transcribing voice notes, drafting quotes, expenses and events | Only the content a user sends to an AI feature, with the workspace's product and category names needed for the draft | United States | OpenAI data processing addendum (POPIA s72(1)(a) and (b)) | Business API: not used to train models. May be kept up to 30 days for abuse monitoring, then deleted. |
Providers acting for themselves
These providers are not our subprocessors. They process information as independent responsible parties under their own terms, when you choose to use them:
- Payfast (South Africa). Takes subscription payments, and invoice payments through a workspace's own PayFast account. Card details go only to PayFast. See PayFast's privacy policy.
- Google LLC (United States). Only if a user connects Google Calendar, to add events the user approves. You can disconnect at any time. See Google's privacy policy.
Changes and objections
We email workspace owners and update this page at least 30 days before a new subprocessor starts processing customer personal information, where practicable. Raise objections at info@mavecy.com. The process is in section 3 of the Data Processing Agreement.