Sub-processor List

Draft — subject to final review by counsel. Effective 3 June 2026.

Mishale engages the following sub-processors to operate the service. We require each to provide appropriate data-protection and security commitments. We will update this list before adding or materially changing a sub-processor.

Current sub-processors - Google LLC — sign-in (Google OAuth) and product analytics (Google Analytics 4). Data: account identity, IP, usage events. Region: US/Global. - Stripe, Inc. — payment processing and billing records. Data: purchase and payment metadata (no full card data stored by Mishale). Region: US/Global. - Resend (Plus Five Five, Inc.) — transactional email (sign-in links, purchase confirmations). Data: email address, message content. Region: US. - Anthropic, PBC — AI inference used to interpret design queries and run advisory review. Data: the design query/intent text you submit. Region: US. - OpenAI, L.L.C. — AI inference (query interpretation / fallback). Data: the design query/intent text you submit. Region: US. - [Cloud hosting provider — to confirm] — infrastructure hosting and storage of the application and databases. Data: all categories, hosted on isolated infrastructure. Region: EU/US.

Notes Design inputs sent to AI inference providers are processed to operate the service under confidentiality and data-processing terms; they are not used to publicly disclose your program. See the Privacy Policy and Data Processing Agreement for details. Questions: jambo@mishale.bio.