PopMCPThis page lists the third-party subprocessors that PopMCP uses to help deliver the Service, together with what each one does, the personal data it may process, and where it processes that data. We publish this list for transparency and as part of the commitments described in our Privacy Policy and Data Processing Agreement.
The subprocessors below reflect PopMCP's current infrastructure. We update this list when a subprocessor is added or replaced; to be notified of changes, contact legal@popmcp.com.
1. Overview
A subprocessor is a third party engaged by PopMCP that may process personal data on our behalf in order to provide the Service. We require our subprocessors to protect personal data under data-protection obligations that are, in substance, no less protective than those we commit to in our Data Processing Agreement at /legal/data-processing-agreement.
PopMCP acts as a processor for the personal data it handles on your behalf, and you act as the controller. The subprocessors below support functions such as database hosting, application compute, payments, email delivery, analytics, and sign-in.
2. Current Subprocessors
The following subprocessors are currently engaged to process personal data as part of delivering the Service:
| Subprocessor | Purpose | Data processed | Location / Region |
|---|---|---|---|
| Supabase | Managed PostgreSQL database and Google OAuth sign-in | Account and operational data, authentication identifiers | United States |
| Railway | Application hosting and compute | All application data processed in transit and at rest | United States |
| Stripe | Payment processing and subscription billing | Billing contact and payment metadata (no card numbers stored by PopMCP) | Global |
| Google (Gmail SMTP) | Transactional email delivery | Recipient email address and message content | United States |
| PostHog | Product analytics | Pseudonymous usage events, IP-derived approximate location | United States (US cloud; self-hostable) |
| OAuth sign-in identity | Email address, name, and avatar | Global |
3. Connectors You Authorize
The third-party platforms you choose to connect, such as your email, commerce, analytics, payments, or support tools, are not PopMCP subprocessors. They are your own chosen processors: you decide which providers to connect and what data flows to them, and PopMCP processes that data on your documented instructions when you or your AI clients invoke tool operations.
Your use of those connected platforms is governed by each platform's own terms and privacy policy. We list them here in this general way for transparency, but they are controlled by you, not engaged by PopMCP as subprocessors on your behalf.
4. Changes and Notifications
We may add, remove, or replace subprocessors as the Service evolves. When we intend to add or replace a subprocessor that processes personal data on your behalf, we will provide reasonable advance notice so that you have an opportunity to object on reasonable, data-protection grounds, as described in our Data Processing Agreement.
You can subscribe to subprocessor change notifications by contacting privacy@popmcp.com, and we will keep this page updated to reflect the subprocessors currently in use.
5. Contact
Questions about our subprocessors may be sent to:
PopMCP