Provider and processing information
This register describes service functions and relevant provider documents. A provider's establishment is not a guarantee that all its processing stays in that country.
This is a dated copy. The terms applicable to an order depend on the version accepted with that order. View current documents.
On this page
Hosting and database
Hostman LTD, established in Cyprus, supplies application/static-site hosting and the managed MySQL database. The service handles account, workspace and application records and technical data needed to host and recover them. The production application and managed MySQL database are configured in Frankfurt, Germany; this was checked on 29 October 2026. Physical database backups are configured daily, with one retained copy. These settings do not establish every backup-storage or remote-support location and are not a blanket EU or Cyprus residency commitment.
Provider source: Hostman legal documents. Request the locations and applicable contractual processing/transfer details relevant to your workspace from our privacy contact.
Requested AI research
OpenAI API services process relevant queries, selected public evidence and limited context needed for requested discovery, analysis, translation and Scout assistance. The current OpenAI DPA identifies OpenAI OpCo, LLC for customers outside the EEA/Switzerland and OpenAI Ireland Ltd for customers based there, under the applicable account agreement. Processing can include the United States and provider subprocessors; no zero-retention or exclusive regional processing promise is made by this notice.
Provider sources: OpenAI DPA and subprocessor information. Legacy SerpAPI, Brave and Tavily code references are not a claim that those services receive current search data; the current search/model configuration uses OpenAI.
Transactional email
Plus Five Five, Inc. (Resend), United States, supplies requested transactional email such as recovery, account notifications and demo confirmations. It receives the recipient, necessary message content and delivery data for that function, not a general copy of the CRM or connected mailbox. Its infrastructure/subprocessors can involve US processing.
Provider sources: Resend DPA, including EU clauses and the UK Addendum where applicable, and its subprocessor list.
Payments and optional connected services
Stripe handles hosted Checkout, subscription management and payment data under the terms applicable to the merchant account. Stripe may be an independent controller for its legal, payment and fraud obligations and a processor for specified activities. Our application stores necessary customer/subscription identifiers, status and contract evidence, rather than full payment-card details. See Stripe's privacy notice.
Google supplies optional, consented Google Analytics on public pages; Google and Microsoft also provide customer-authorised mailbox APIs where connected. Their applicable entities, independent activities and access terms are explained in Google's notice and Microsoft's notice. The authorisation screen identifies requested permissions. A customer's own mail-provider relationship is not indiscriminately treated as our subprocessor contract.
Transfers, changes and requests
Depending on the function, processing and remote access can involve the UK, EEA, United States and other provider locations. Where a restricted transfer applies, the applicable adequacy route or contractual safeguards and necessary assessments must cover it. Ask hello@magmaproductions.dev for service-specific locations and a copy or description of the applicable safeguards. Public provider policies do not replace our own processing obligations.
We update this register when a relevant provider changes and follow the DPA's notice/objection process for new subprocessors receiving customer personal data. The Privacy policy explains data categories, purposes and individual rights.
Version 2026-10-29 · Magma Productions Limited · hello@magmaproductions.dev