Infrastructure
These process customer data, including mail content, as part of delivering the Service.
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting the API and this website, the database, storage of sealed message bodies and attachments, DNS for domains you bring, service logs, content delivery and DDoS protection. Also receives mail through Email Routing and sends it through Email Sending. Inbound mail arrives in the clear and is sealed to your address's key before anything is stored. Mail you send passes through in the clear and is not stored by us. | Database and storage in Western Europe; edge network global |
| Expo (650 Industries, Inc.), with Apple Push Notification service and Firebase Cloud Messaging | Delivering push notifications to phones that have turned them on. Receives the device push token, fixed text such as "You have new mail." and an in-app link holding an internal address or device id. No sender, subject, message content or email address. | United States |
Operations
These process payments for paid plans. You give them your payment details on their own checkout or in the store, not ours. From us they receive the plan, the amount and our payment reference, never your account id or mail content.
| Subprocessor | Purpose | Location |
|---|---|---|
| Polar Software, Inc. | Card payments on the website, as merchant of record: charges the card, bills monthly renewals, handles sales tax and VAT, and runs the portal where a card subscription is managed or cancelled. Collects the email address and payment details you give at checkout. Receives our payment reference and the plan, never your account id. | United States |
| NOWPayments | Cryptocurrency payments on the website. Receives our payment reference, the plan and the amount, never your account id. | Seychelles |
| Apple and Google | Subscriptions bought inside the iOS and Android apps, through the App Store and Google Play. We read each purchase back from Apple's or Google's own API to confirm it. | United States and Ireland |
Not on this list. There is no transactional email provider. Service notices go on this website and, where you turn them on, arrive as push notifications. There is no product analytics vendor.
Change notice
We give at least 30 days' notice before a new subprocessor starts processing customer data. To be notified, email hello@mailcycle.email with the subject “Subscribe to subprocessor notifications” and we will add you to the list.
Where a change is urgent, such as replacing a vendor that has failed or become a security risk, we may act sooner and notify you as quickly as we can, with an explanation.
Objecting
If you have a reasonable data protection objection to a new subprocessor, tell us within the notice period at hello@mailcycle.email. We will work with you to find an alternative. If none is workable, you may terminate the affected part of the Service without penalty and receive a pro rata refund of prepaid fees, as set out in section 5 of the DPA.