Sub-processors
Manda engages the third-party processors listed below to deliver the Service. Each is bound by a Data Processing Agreement and may process personal data only on our documented instructions. We notify customers by email at least 14 days before any new sub-processor begins processing personal data, and you may object before then. Core sub-processors are engaged for every Manda customer. Connector sub-processors are engaged only when the customer chooses to connect that platform via the Data Bank; if a customer never connects a platform, no data is exchanged with it.
1. Core sub-processors
Engaged for every Manda customer. These are essential to operating the Service.
| Name | Purpose | Region | Categories | Transfer mechanism | DPA |
|---|---|---|---|---|---|
| Anthropic, PBC | AI inference (Claude API) for natural-language insights and chat | United States | User prompts, Conversation context, Ad-account metadata in queries | EU-US Data Privacy Framework (DPF) | anthropic.com/legal/dpa |
| Google Cloud Platform (Google LLC) | Analytical data warehouse (BigQuery), raw-byte object storage (GCS), and the modelling services (Cloud Run) | European Union (europe-west1) | All harmonized and model-ready application data, Raw provider payloads | Standard Contractual Clauses | cloud.google.com/terms/data-processing-addendum |
| Supabase Inc. | Authentication, primary database, file storage | European Union (aws eu-west-1) | Account data, All application data | Standard Contractual Clauses (2021/914) | supabase.com/legal/dpa |
| Resend, Inc. | Transactional email delivery | United States | Email address, Email content (transactional) | Standard Contractual Clauses | resend.com/legal/dpa |
| Functional Software, Inc. (Sentry) | Error tracking and performance monitoring | United States | Stack traces, Hashed user identifiers, Request metadata (PII scrubbed) | EU-US Data Privacy Framework (DPF) | sentry.io/legal/dpa/ |
| Vercel Inc. | Application hosting and infrastructure | European Union (Dublin, dub1) | All application traffic at the network layer | Standard Contractual Clauses | vercel.com/legal/dpa |
2. Connector sub-processors
Engaged only when you choose to connect the corresponding platform via the Data Bank. "Available" means the connector is ready in production today; "Pending" means the integration is built but awaiting the platform’s OAuth approval and is not yet usable.
| Name | Status | Purpose | Region | Categories | Transfer mechanism |
|---|---|---|---|---|---|
| Google LLC (Google Ads, Campaign Manager 360, GA4) | AVAILABLE | Ad-data and analytics ingestion (Google Ads, Campaign Manager 360, GA4) when user connects the platform | United States | OAuth tokens, Ad account metadata, Performance metrics | EU-US Data Privacy Framework (DPF) |
| Google LLC (BigQuery — a table in the customer’s own project) | PENDING | Warehouse-table ingestion (BigQuery) — Manda reads one table a workspace admin selects and lands its rows through the same door a CSV arrives at. Reads only: no query job is run in the customer’s project and no query bytes are billed to them | United States / EU regions available (the customer’s own dataset location) | OAuth tokens, Project, dataset and table metadata, The rows of the one table the customer selects | EU-US Data Privacy Framework (DPF) |
| Meta Platforms, Inc. | AVAILABLE | Ad-data ingestion (Meta Ads / Facebook / Instagram) | United States | OAuth tokens, Ad account metadata, Performance metrics | EU-US Data Privacy Framework (DPF) |
| Salesforce, Inc. | PENDING | CRM-data ingestion (when connected) | United States | OAuth tokens, CRM metadata | EU-US Data Privacy Framework (DPF) |
| Amazon.com, Inc. (S3, Athena) | PENDING | Data-warehouse access when connected | United States / EU regions available | IAM credentials, Warehouse metadata | EU-US Data Privacy Framework (DPF) |
| TikTok Pte. Ltd. | AVAILABLE | Ad-data ingestion (TikTok Ads) | Singapore / United States | OAuth tokens, Ad account metadata, Performance metrics | Standard Contractual Clauses |
| LinkedIn Corporation | PENDING | Ad-data ingestion (LinkedIn Ads) | United States | OAuth tokens, Ad account metadata, Performance metrics | EU-US Data Privacy Framework (DPF) |
| Snap Inc. | PENDING | Ad-data ingestion (Snapchat Ads) | United States | OAuth tokens, Ad account metadata, Performance metrics | Standard Contractual Clauses |
| X Corp. | PENDING | Ad-data ingestion (X Ads) | United States | OAuth tokens, Ad account metadata, Performance metrics | EU-US Data Privacy Framework (DPF) |
| HubSpot, Inc. | PENDING | Marketing-performance ingestion (HubSpot) — marketing email statistics and campaign reports, at campaign grain | United States / EU regions available | Private-app tokens, Account metadata, Campaign and marketing-email names, dates and aggregate counters (no contacts, no deals, no names, email addresses or phone numbers) | EU-US Data Privacy Framework (DPF) |
| DataForSEO LLC | PENDING | Competitive search-volume ingestion (DataForSEO) — monthly Google Ads search volume for keywords a workspace names | United States / EU regions available | Keywords a workspace declares (brand and competitor names), country and language codes, month ranges (no workspace identifier, no personal data, no performance figures) | Standard Contractual Clauses |
| Pinterest, Inc. | PENDING | Ad-data ingestion (Pinterest Ads) | United States | OAuth tokens, Ad account metadata, Performance metrics | EU-US Data Privacy Framework (DPF) |
| Reddit, Inc. | PENDING | Ad-data ingestion (Reddit Ads) | United States | OAuth tokens, Ad account metadata, Performance metrics | Standard Contractual Clauses |
| Spotify AB | PENDING | Ad-data ingestion (Spotify Ad Studio) | Sweden / United States | OAuth tokens, Ad account metadata, Performance metrics | Adequacy (EU) / SCCs |
| The Trade Desk, Inc. | PENDING | Ad-data ingestion (programmatic platform) | United States | API credentials, Campaign metadata, Performance metrics | Standard Contractual Clauses |
| Profound | AVAILABLE | AI-visibility observation ingestion (share of AI answers, citations) when the workspace connects the provider | United States | API credentials (encrypted at rest), Prompt and answer metadata, Visibility metrics | Standard Contractual Clauses |
| Shopify Inc. | AVAILABLE | Commerce-data ingestion (orders, products) | Canada (adequacy) | OAuth tokens, Store metadata, Aggregated order data | EU adequacy decision (Canada PIPEDA) |
| Customer-managed MySQL database | PENDING | Connector lets users ingest data from a MySQL database they operate themselves | Customer-controlled | DB credentials (encrypted at rest), Schema metadata, Query result rows | N/A — customer-controlled infrastructure |
| Customer-managed PostgreSQL database | PENDING | Connector lets users ingest data from a PostgreSQL database they operate themselves | Customer-controlled | DB credentials (encrypted at rest), Schema metadata, Query result rows | N/A — customer-controlled infrastructure |
| Customer-managed Vertica database | PENDING | Connector lets users ingest data from a Vertica database they operate themselves | Customer-controlled | DB credentials (encrypted at rest), Schema metadata, Query result rows | N/A — customer-controlled infrastructure |
| Snowflake Inc. | PENDING | Cloud-warehouse data ingestion when connected | United States / EU regions available | DB credentials (encrypted at rest), Schema metadata, Query result rows | EU-US Data Privacy Framework (DPF) |
| Databricks, Inc. | PENDING | Lakehouse data ingestion when connected | United States / EU regions available | DB credentials (encrypted at rest), Schema metadata, Query result rows | EU-US Data Privacy Framework (DPF) |
| SAP SE (Datasphere / Data Warehouse Cloud) | PENDING | SAP Datasphere / Data Warehouse Cloud data ingestion when connected | European Union (Germany) | OAuth tokens, Schema metadata, Query result rows | Adequacy (EU controller-processor relationship) |
| Supabase Inc. (customer-connected project) | PENDING | Ingestion from a Supabase project the customer connects (distinct from Manda’s own Supabase listed above as a core sub-processor) | United States (configurable region) | Project credentials (encrypted at rest), Schema metadata, Query result rows | Standard Contractual Clauses (2021/914) |
| Adobe Inc. (Adobe Analytics) | PENDING | Web-analytics data ingestion (Adobe Analytics) | United States | OAuth tokens, Report metadata, Performance metrics | EU-US Data Privacy Framework (DPF) |
| Adobe Inc. (Marketo Engage) | PENDING | Marketing-automation data ingestion (Marketo Engage) | United States | OAuth tokens, Lead/contact metadata, Engagement metrics | EU-US Data Privacy Framework (DPF) |
| Microsoft Corporation (Dynamics 365) | PENDING | CRM-data ingestion (Microsoft Dynamics 365) | United States / EU regions available | OAuth tokens, CRM metadata | EU-US Data Privacy Framework (DPF) |
| Microsoft Corporation (Xandr / Microsoft Curate) | PENDING | Programmatic ad-data ingestion (Xandr / Microsoft Advertising Curate) | United States | API credentials (encrypted at rest), Campaign metadata, Performance metrics | EU-US Data Privacy Framework (DPF) |
| Taboola, Inc. | PENDING | Native-ad data ingestion (Taboola Ads) | United States | OAuth tokens, Campaign metadata, Performance metrics | Standard Contractual Clauses |
| Rakuten Marketing LLC | PENDING | Affiliate-ad data ingestion (Rakuten Advertising) | United States | OAuth tokens, Campaign metadata, Performance metrics | Standard Contractual Clauses |
| StackAdapt Inc. | PENDING | Programmatic ad-data ingestion (StackAdapt) | Canada (adequacy) | API credentials (encrypted at rest), Campaign metadata, Performance metrics | EU adequacy decision (Canada PIPEDA) |
| Teads (Outbrain Inc.) | PENDING | Outstream-video ad-data ingestion (Teads) | United States / France | API credentials (encrypted at rest), Campaign metadata, Performance metrics | Standard Contractual Clauses |
| AppLovin Corp. | PENDING | Mobile-ad data ingestion (AppLovin) | United States | API credentials (encrypted at rest), App-install metadata, Performance metrics | EU-US Data Privacy Framework (DPF) |
| Klaviyo, Inc. | PENDING | Email/SMS marketing-data ingestion (Klaviyo) | United States | API credentials (encrypted at rest), Profile metadata, Engagement metrics | EU-US Data Privacy Framework (DPF) |
| Amplitude, Inc. | PENDING | Product-analytics data ingestion (Amplitude) | United States | API credentials (encrypted at rest), Event metadata, User analytics | EU-US Data Privacy Framework (DPF) |
| Google LLC (Display & Video 360) | PENDING | Programmatic ad-data ingestion (Display & Video 360) when user connects the platform | United States | OAuth tokens, Advertiser and campaign metadata, Performance metrics | EU-US Data Privacy Framework (DPF) |