Subprocessors
Last updated 20 October 2026 · effective the same day
These are the service providers that process personal data for us when we run mado for our customers. Each is bound by a data processing agreement with terms at least as protective as our Data Processing Addendum.
Recordings, demos and viewer analytics are stored and processed in the EU, with two opt-in exceptions: AI assist and Voice & music. Both are off for every workspace until an owner or admin turns them on in Settings, and Studio names the provider and region before they do. With AI assist off, step names come from text recognition on our own servers and nothing reaches a model provider. With Voice & music off, Watch mode plays silent and nothing reaches ElevenLabs.
Subprocessors
- Hetzner Online GmbH
- What for
- Servers, database, media storage and backups
- Data
- All Content, account data and viewer analytics
- Where
- Finland (Helsinki), EU
- When
- Always
- Resend, Inc.
- What for
- Sending email: sign-in links, invitations, notices and viewer alerts
- Data
- Recipient email addresses and the text of those emails
- Where
- Sent from the EU (Ireland); US company
- When
- Always
- Anthropic, PBC
- What for
- AI assist: writing titles, step text, narration and chapters, translation, planning demos from a scan, planning promo films, and choosing the Helper’s next step
- Data
- Step screenshots and their recognised text, screenshots you attach to a request, and scan outline text, with detected personal details replaced. For the Helper: the page’s address and title, an outline of its headings and sections, the names and roles of the controls it may use, its last steps, and the app map it read (routes, endpoint names and navigation links), with the same details replaced; plus the notes and rules you wrote for that app, as you wrote them; never a screenshot. For a promo film: the demo’s text, the product website’s text and your brief, with the same details replaced; never a screenshot
- Where
- United States
- When
- Only for workspaces that turn on AI assist
- ElevenLabs
- What for
- Voice & music: generated narration, background music and sound effects, and turning your own recorded voice into text
- Data
- Narration text (including a promo film’s voice lines), music style prompts and, if you ask for a transcript in record mode, your microphone recording. Never a screenshot or your webcam
- Where
- United States
- When
- Only for workspaces that turn on Voice & music
Other companies that receive data
These are not our subprocessors: they process data as independent controllers under their own terms and privacy policies. We list them so the picture is complete.
- Stripe and Link (Stripe’s reseller)
- What for
- Merchant of record for paid plans: checkout, tax, receipts, invoices, refunds and payment support
- Data
- Buyer name, email, billing address, tax and payment details. No Content
- Where
- EU (Ireland) and United States
- When
- When someone buys a paid plan
- Google
- What for
- Google sign-in
- Data
- Confirms your email, name and profile picture to us
- Where
- United States and elsewhere
- When
- Only if you choose to sign in with Google
If a customer turns on Slack or email alerts, alert details go to the Slack workspace or inboxes that customer chose. That is the customer’s own tool, not ours.
What AI assist sends
For a workspace that turned it on, a new recording sends its step screenshots and the text recognised on them to Anthropic in the United States. Emails, phone numbers, card numbers, IBANs and labelled names are replaced in that text first. The screenshots are not altered at upload, so use redaction or test data for anything sensitive; when AI assist is run again from the editor, your redactions are applied to the screenshots before they are sent, along with your request and any screenshots you attach to it. Translation sends the demo’s text only. So does “Build my help hub”: its planner receives your answers to its questions, the titles and step text of the demos you add and the pages they were recorded on, and never a screenshot. Making a demo from a scan, or asking for suggestions, sends the scan’s outline text — page addresses, titles, headings and the names and roles of buttons, links and fields, with the same details replaced — and what you asked for, never a screenshot; the demo it starts is then written as for a new recording. The Helper sends, for each step it takes, the current page’s address and title, an outline of its headings and sections, the names and roles of the controls it may use, its last steps, the addresses and titles of screens already captured or known, and the app map it read (routes, endpoint names and navigation links), with the same details replaced, plus the notes and rules you wrote for that app, which are sent as you wrote them, and never a screenshot. Planning a promo film sends the published demo’s title, closing button and each step’s name, description, caption and narration, the product website’s text when the demo has one on record, and your brief (length, format, language, what to stress, the audience), with the same details replaced, and never a screenshot. Anthropic processes it under its commercial terms and data processing addendum, which do not allow training on it.
When a workspace member gives a product website in the AI assist brief, our own servers fetch it first — never the processor directly — and send Anthropic only the page text, headings and sign-up links we read from it, to use the product’s real name and offer a working end-card link. We do not fetch a URL that resolves to a private or internal address.
What Voice & music sends
For a workspace that turned it on, generating a step’s voiceover sends that step’s narration text to ElevenLabs in the United States; generating a demo’s music sends the short style prompt behind it (for example “calm”); rendering a promo film sends each scene’s voice line the same way. It never sends a screenshot. For a personalisation placeholder, only its fallback text is sent, never a viewer’s value.
If you record with your microphone in the browser extension’s record mode and choose to use a transcript, that microphone recording is sent to ElevenLabs in the United States to turn it into text, with the demo’s language as a hint. Your webcam video is never sent.
Transfers
Transfers to providers in the United States rely on the EU Standard Contractual Clauses in each provider’s data processing agreement, or on the EU–US Data Privacy Framework where the provider is certified.
Changes to this list
Before a new subprocessor starts processing customers’ personal data, we update this page and email workspace owners at least 30 days ahead. Customers can object in that time, as set out in the Data Processing Addendum. Questions: hello@mado.show.