This is an English translation of the Romanian original. The Romanian version is the legally binding one; if the two differ, the Romanian version prevails.
These are the providers we use to run Manifolio and that may process personal data on behalf of our customers or for user accounts. This list forms part of the Data Processing Agreement (Annex 3) and is updated as set out in section 6 of it. The descriptions below reflect the position at the date of this version; the specific services used with each provider may evolve within the stated purpose. Providers that do not process our customers’ personal data (for example accounting services or internal tools without access to the Service) are not included. Manifolio is operated by DIMAX.RO S.R.L.
Current sub-processors
| Provider | What it does for Manifolio | Data | Where | Transfer safeguards |
|---|---|---|---|---|
| Cloudflare, Inc. (USA) | infrastructure services, such as running the application (Workers), the network and edge cache, DNS, attack and bot protection; storing media files, export archives and signed service orders (R2, EU jurisdiction); image transformations (Images); configuration and short-lived caches (KV); the database connection (Hyperdrive); spam protection for forms (Turnstile), only if the customer turns it on | all data in transit, including IP addresses; media files (stored without embedded metadata: EXIF, XMP and IPTC are removed on upload); export archives (7 days); signed service orders (private, our team only) | global network; files stored in the EU | EU–US Data Privacy Framework; standard contractual clauses |
| Cloudflare, Inc. (USA): Email Sending and Email Routing | sending service emails (for example invitations, password resets, security alerts, notifications, confirmations of GDPR requests); forwarding messages received at hello@, privacy@, security@ and authorities@manifolio.com to the company’s own mailbox, where they are read | recipient and sender addresses, subject, message content and attachments, in transit | global network | EU–US Data Privacy Framework; standard contractual clauses |
| Supabase, Inc. (USA) | the managed PostgreSQL database, hosted on Amazon Web Services in the Frankfurt region (eu-central-1); support and operation of the service | accounts, sessions, audit logs, content, form submissions, statistics, API logs, GDPR requests | Frankfurt, Germany (EU); support access may come from outside the EU | standard contractual clauses (Decision (EU) 2021/914, modules 2 and 3), incorporated into Supabase’s data processing agreement |
| Anthropic, PBC (USA) | AI writing features (Claude): only for organisations where an owner has turned them on, only for requests a user starts | the text or image in that request and its context (field and type names, brand voice), which may contain personal data if the content does | USA | standard contractual clauses (modules 2 and 3), incorporated into Anthropic’s data processing addendum |
Anthropic. At the date of this version, under Anthropic’s commercial terms, it may not train models on customer content received through the API. Retention periods are set by Anthropic’s policies, which may change; at the date of this version, inputs and outputs are deleted automatically, as a rule within 30 days, except for requests flagged for violating Anthropic’s usage policy (which may be kept longer, for example up to 2 years) and where the law requires it. We do not have a Zero Data Retention agreement with Anthropic. Manifolio does not keep the content sent or received, only data about the request (for example usage and outcome). While an organisation has AI features off (the default), nothing is sent to Anthropic. If we change or add a model provider, we follow section 6 of the Data Processing Agreement.
Supabase. Supabase’s own sub-processors are listed on its sub-processor page; the database itself is hosted by Amazon Web Services in Frankfurt. Provider backups depend on the plan used: the plan used at the date of this version does not include them, and on Supabase’s paid plans daily backups are kept for a limited number of days (for example 7 or 14) and then deleted automatically.
Payments (planned, independent controller)
| Provider | Role | Data | Where | Safeguards |
|---|---|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) | independent controller for the payment data it processes and, where applicable, a payment service provider authorised to carry out payment operations on our behalf, intermediating the financial relationship between Manifolio and its customers | the customer’s billing data (company, tax details, contact person, email), card data (processed only by Stripe), payment history, fraud and know-your-customer checks | EU, with transfers to Stripe, LLC (USA) | EU–US Data Privacy Framework; standard contractual clauses |
Stripe starts processing data only once online payments start. We will announce this in advance, with reasonable notice, by email to organisation owners or in the admin. Stripe’s privacy policy applies to the data it processes as a controller.
Changes
We announce any intended addition or replacement of a sub-processor with reasonable notice, as a rule at least 30 days, by email to organisation owners, in the admin or on this page, except in emergencies. The customer may object under section 6 of the Data Processing Agreement; if no solution is found, its remedy is to end the Agreement for the affected services. Changes that do not add or replace a sub-processor (for example a product name or the use of another service of an existing provider, for the same purpose and in the same locations) are updated on this page without notice.
Questions: privacy@manifolio.com.