Core Infrastructure, Hosting and Databases
Supabase, Inc.
Purpose: Database, authentication, file and object storage, and backend infrastructure.
Personal Data / Processing: Stored Customer data, Workspace data, user accounts, authentication information, files and other Personal Data stored as part of the Miiwa Solution.
Underlying infrastructure: Supabase uses Amazon Web Services (AWS) as its underlying cloud provider. For Miiwa's primary Supabase project, the relevant hosting region is AWS eu-west-1 in Ireland. The data flow is therefore: Customer → Miiwa → Supabase → AWS.
Processing location: Ireland (EU), AWS eu-west-1, for the primary database and storage. Support and other processing may involve locations outside the EEA under the provider’s DPA.
Transfer mechanism: Supabase’s applicable DPA, including the EU Standard Contractual Clauses (SCCs) for restricted transfers and onward transfers. Hosting in Ireland does not exclude international access or processing.
Provider data protection terms
Vercel, Inc.
Purpose: Hosting, application infrastructure and delivery of the Miiwa Platform.
Personal Data / Processing: Personal Data and technical information processed in connection with the operation and delivery of the Platform.
Processing location: United States and other global locations used by Vercel and its approved sub-processors.
Transfer mechanism: Vercel’s applicable DPA and SCCs. The EU-U.S. Data Privacy Framework (DPF) also applies to transfers covered by Vercel’s certification.
Monitoring and Communications
Functional Software, Inc. (dba Sentry)
Purpose: Error and performance monitoring, technical troubleshooting and security monitoring.
Personal Data / Processing: Limited technical information, error and operational data, and any Personal Data contained in technical error events. Miiwa's configuration actively uses PII scrubbing to minimise personally identifiable information.
Processing location: Frankfurt, Germany (EU), for Miiwa’s configured Sentry data storage. Certain support and administrative processing may take place outside the EEA.
Transfer mechanism: Sentry’s DPA. Data storage is within the EEA; covered transfers to the United States rely on the EU-U.S. DPF, with SCCs applying where required under the DPA.
Provider data protection terms
Plus Five Five, Inc. (dba Resend)
Purpose: Sending transactional system emails and other necessary email functionality within the Miiwa Solution.
Personal Data / Processing: Email addresses, email metadata, delivery information and message content where necessary for the relevant functionality.
Processing location: United States.
Transfer mechanism: Resend’s applicable DPA; EU-U.S. DPF for covered transfers to its certified US entity and SCCs where required under the DPA.
AI Models and Processing
Note: Only information necessary for the specific task is disclosed to the relevant AI provider. Data is used solely to perform the requested AI task and is not used for general model training.
OpenAI Ireland Ltd.
Purpose: AI model Processing for Specialist Jobs, Assistant Chat and other AI functionality where OpenAI is selected or used.
Personal Data / Processing: Prompts, instructions, relevant parts of the Customer's context and other Personal Data included in the AI request.
Processing location: United States and other locations documented by OpenAI for its services and sub-processors. Miiwa uses the standard API endpoint; processing is not restricted to Ireland or the EEA.
Transfer mechanism: OpenAI’s applicable DPA. Restricted onward transfers use SCCs or an applicable adequacy decision, as specified in the DPA.
Provider data protection terms
Anthropic, PBC
Purpose: AI model Processing for relevant AI functionality where Anthropic is selected or used.
Personal Data / Processing: Prompts, instructions, relevant parts of the Customer's context and other Personal Data included in the AI request.
Processing location: Data storage in the United States; processing may also take place in Europe, Asia and Australia under Anthropic’s documented infrastructure arrangements.
Transfer mechanism: Anthropic’s applicable DPA, including the EU SCCs for restricted international transfers.
Provider data protection terms
Google / Google Ireland Limited
Purpose: Gemini model processing where Google is selected or used.
Personal Data / Processing: Prompts, instructions, relevant parts of the Customer's context and other Personal Data included in the AI request.
Processing location: Global, including the United States and other countries where Google or its agents maintain facilities. Miiwa uses the Gemini API without a configured regional Vertex AI endpoint; processing is not restricted to the EEA.
Transfer mechanism: Google’s Data Processing Addendum for Products where Google is a Data Processor, applicable to the Gemini API. EU-U.S. DPF for covered transfers to certified Google entities in the US; SCCs for other restricted transfers as specified in the DPA.
Miiwa Creative Studio (Design and Content)
These providers are activated when the Customer uses the built-in visual workspace for design and content, Creative Studio, provided in collaboration with VistaCreate.
Crello Limited (dba VistaCreate)
Purpose: Provision of the underlying design functionality within Miiwa Creative Studio.
Personal Data / Processing: Design content, text, images, videos, logos, brand materials and other user uploads that the Customer chooses to process in Creative Studio.
Processing location: Global, including the United States and other locations described in Vista’s Privacy Notice. Crello Limited is established in Cyprus; this does not restrict processing to Cyprus or the EEA.
Transfer mechanism: Applicable adequacy decisions or EU SCCs for transfers outside the EEA, as described in Vista’s Privacy Notice.
Provider data protection terms
DepositPhotos Inc.
Purpose: Provision, search and licensing of stock images, graphics and creative assets in connection with Miiwa Creative Studio.
Personal Data / Processing: Search queries and information relating to selected or licensed assets.
Processing location: United States and other countries used by Depositphotos and its service providers.
Transfer mechanism: EU SCCs for transfers outside the EEA, as described in Depositphotos’ Privacy Policy.
Changes and External Integrations
Optional Third-party Connections
If a Customer separately requests and agrees an integration with an external third-party system, for example the Customer's own CRM or ERP system, and that connection results in an external party processing data on Miiwa's behalf, that party will be regarded as a specific Sub-processor for the relevant Customer.
Updates to the List
Miiwa undertakes to keep this list up to date on an ongoing basis.
When Sub-processors are added or replaced, existing B2B customers will be notified in accordance with the notice period set out in the Customer's applicable Data Processing Agreement (DPA) before the change takes effect.