MARCØ — Sub-Processors List (Public)

Document version: 1.1 Last updated: 2026-09-11 Next scheduled review: Quarterly (next: 2026-12-11) Notification mechanism: 30-day notice via email + this page changelog before adding/replacing any Sub-Processor

This is a courtesy English translation provided for convenience. In case of any conflict or discrepancy, the Italian version (/sub-processors) prevails.

---

1. What this page is

This page lists the Sub-Processors used by MARCØ to provide the Service. Under Art. 28(2)+(4) GDPR, MARCØ is required to:

• Inform its Customers (Controllers) about the Sub-Processors in use;
• Give at least 30 days' prior notice of any addition or replacement;
• Allow a right of reasoned objection.

For the contractual details of the Sub-Processor cascade, see the main DPA (DPA.md) §6 and Annex III of the same document.

---

2. Active Sub-Processors (16)

Production infrastructure (database, API, internal services) is not outsourced: it is operated directly by Telos Intelligence LLC on its own hardware located in Italy (EU) and is reachable from outside only through Cloudflare Tunnel (entry 1). See §4.

2.1 Infrastructure & Storage

1. Cloudflare, Inc. — Tunnel & Access

• Service: Public access to the application and APIs (app-marco.schedy.app) via Cloudflare Tunnel; protection of administrative access with Cloudflare Access
• Data categories: All HTTP traffic in transit (requests and responses, including account and content Personal Data), IP addresses, connection metadata
• Registered office: San Francisco, US
• Data location: Cloudflare global network (edge)
• Transfer safeguards: EU-US Data Privacy Framework (DPF certified) + SCCs Module 3
• Certifications: ISO/IEC 27001, SOC 2 Type II, EU DPF
• DPA link: https://www.cloudflare.com/cloudflare-customer-dpa/
• Declared since: 2026-09-11 (already in use before that date)

2. Cloudflare, Inc. — R2 Object Storage

• Service: Storage of assets (image, video, music) generated by the Service + daily database backup (private bucket, 30-day retention)
• Data categories: Binary assets (images, video, audio) + metadata (URL, mime, size); in the backup, all Customer Personal Data
• Registered office: San Francisco, US
• Data location: Eastern Europe (R2 location hint EEUR, verified 2026-09-11); not a bucket with guaranteed EU jurisdiction
• Transfer safeguards: EU-US Data Privacy Framework (DPF certified) + SCCs Module 3
• Certifications: ISO/IEC 27001, SOC 2 Type II, EU DPF
• DPA link: https://www.cloudflare.com/cloudflare-customer-dpa/
• Privacy Policy: https://www.cloudflare.com/privacypolicy/
• Active since: 2026-04-15

3. Cloudflare, Inc. — Pages

• Service: Deployment of sites generated by the Site Builder agent (static HTML/CSS/JS)
• Data categories: Site content (no inherent Personal Data; any data entered by the Customer is under its responsibility)
• Registered office: San Francisco, US
• Data location: EU + global CDN (edge cache)
• Transfer safeguards: EU-US DPF + SCCs Module 3
• Certifications: same as Cloudflare R2
• DPA link: https://www.cloudflare.com/cloudflare-customer-dpa/
• Active since: 2026-04-15

---

2.2 AI / LLM Providers

4. OpenRouter Inc.

• Service: Sole channel to the text models used by the Service (analysis, research, copy, brand, strategy, sites)
• Data categories: Prompt input + model output, including content provided by the Customer
• Downstream models: z-ai GLM 5.3, MiniMax M3 — the providers running the model receive prompts through OpenRouter, according to its routing
• Registered office: US
• Data location: US
• Transfer safeguards: SCCs Module 3
• DPA link: https://openrouter.ai/terms
• Active since: 2026-05-01

5. fal.ai

• Service: Image and video generation for posts and reels
• Data categories: Image/video prompts + reference images, including photos uploaded by the Customer for photo-based videos
• Downstream models: ByteDance Seedream, MiniMax (video), OpenAI GPT-Image, FLUX
• Registered office: US
• Data location: US
• Transfer safeguards: SCCs Module 3
• DPA link: https://fal.ai/legal/dpa
• Active since: 2026-05-01

6. Suno, Inc.

• Service: AI music generation for video/asset library
• Data categories: Music spec prompt (no PII)
• Registered office: US
• Data location: US
• Transfer safeguards: SCCs Module 3
• DPA link: https://suno.com/legal/dpa
• Active since: 2026-05-01

7. Higgsfield

• Service: Alternative video generation, selectable for photo-based videos
• Data categories: Video prompts + reference images, including photos uploaded by the Customer
• Registered office: US
• Data location: US
• Transfer safeguards: SCCs Module 3
• DPA: being obtained
• Declared since: 2026-09-11 (already configured before that date)

---

2.3 Research & Scraping

8. Tavily

• Service: Web research API (deep research engine)
• Data categories: Query input (no PII)
• Registered office: US
• Data location: US
• Transfer safeguards: SCCs Module 3
• DPA link: https://tavily.com/terms
• Active since: 2026-04-15

9. Firecrawl

• Service: Structured web scraping (competitor analysis, GEO audit, import of the Customer's site)
• Data categories: URL input + scraped HTML content
• Registered office: US
• Data location: US
• Transfer safeguards: SCCs Module 3
• DPA link: https://www.firecrawl.dev/dpa
• Active since: 2026-04-15

---

2.4 Social & OAuth

10. Composio, Inc.

• Service: Social OAuth + posting dispatch (IG / LinkedIn / TikTok / YouTube)
• Data categories: OAuth tokens encrypted at rest + post payload + scheduling metadata
• Registered office: US
• Data location: US
• Transfer safeguards: SCCs Module 3 + per-tenant scope (NO global tokens)
• DPA link: https://composio.dev/legal/dpa
• Active since: 2026-05-01

11. Meta Platforms Ireland Ltd (Instagram / Facebook)

• Service: Publishing and insights via Composio; profile identity sync and analytics via the Graph API directly
• Data categories: IG/FB OAuth tokens + post content + profile data (name, bio, picture)
• Registered office: Dublin, IE (controlled by Meta Platforms Inc., US)
• Data location: US (Meta US) / EU (Meta IE)
• Transfer safeguards: EU-US DPF (Meta US) + SCCs
• Certifications: ISO/IEC 27001 (specific systems), SOC 2
• DPA link: https://www.facebook.com/legal/terms/dataprocessing
• Active since: 2026-05-01

12. LinkedIn Ireland Unlimited Company

• Service: LinkedIn API (posts + analytics insights) — via Composio or the direct API
• Data categories: LinkedIn OAuth tokens + post content
• Registered office: Dublin, IE (controlled by Microsoft Corporation, US)
• Data location: US (Microsoft Azure) / EU (LinkedIn IE)
• Transfer safeguards: EU-US DPF + SCCs
• Certifications: ISO/IEC 27001, SOC 2 Type II (Microsoft umbrella)
• DPA link: https://legal.linkedin.com/dpa
• Active since: 2026-05-01

13. TikTok Pte. Ltd (parent: ByteDance Ltd)

• Service: TikTok API (posts + insights) — access via Composio
• Data categories: TikTok OAuth tokens + post content
• Registered office: Singapore (controlled by ByteDance, Cayman Islands)
• Data location: US (TikTok US) / Singapore / China (concerns)
• Transfer safeguards: SCCs Module 3 + additional Transfer Impact Assessment (see notice below)
• DPA link: https://www.tiktok.com/legal/dpa
• Active since: 2026-05-01

⚠️ TikTok NOTICE: Given the evolving EU regulatory context (ongoing EDPB proceedings, 2023 DPC Ireland decision €345M), MARCØ recommends that the Customer carefully evaluate enabling the TikTok channel. Per-channel opt-out available in the /integrations dashboard.

14. Google LLC

• Service: Sign-in with Google for platform administrators; YouTube Data API for YouTube publishing (via Composio; direct access only if enabled)
• Data categories: Administrators' Google email and profile; for YouTube: OAuth tokens + post metadata
• Registered office: Mountain View, US
• Data location: US / EU multi-region
• Transfer safeguards: EU-US DPF + SCCs Module 3
• Certifications: ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 2/3, EU DPF
• DPA link: https://cloud.google.com/terms/data-processing-addendum
• Active since: 2026-04-15

---

2.5 Billing & Comms

15. Stripe Payments Europe Limited

• Service: Payment processing, subscription billing, metering, top-up packs
• Status: planned for billing; not yet active as of this version
• Data categories: Stripe customer + payment data (NO card data on MARCØ's side — PCI handled by Stripe)
• Registered office: Dublin, IE (Stripe Payments Europe)
• Data location: EU (Dublin) — US fallback for redundancy
• Transfer safeguards: N/A primary (EU) + SCCs Module 3 for US fallback
• Certifications: PCI-DSS Level 1, ISO/IEC 27001, SOC 2 Type II, EU DPF
• DPA link: https://stripe.com/legal/dpa

16. Brevo (Sendinblue) SAS

• Service: Transactional email (HITL approval magic-links, password reset, breach notifications, account emails)
• Data categories: Recipient email + email body + delivery metadata
• Registered office: Paris, FR
• Data location: EU (Paris) — datacenter France
• Transfer safeguards: N/A — data entirely in the EU
• Certifications: ISO/IEC 27001, French CNIL compliance, EU DPF
• DPA link: https://www.brevo.com/legal/dataprocessing/
• Active since: 2026-04-15

---

3. Optional Sub-Processors (Customer BYOK)

The following Sub-Processors are optional and can be activated by Pro+ tier Customers via BYOK (Bring Your Own Key):

BYOK activation means MARCØ is NOT involved in the contractual relationship between the Customer and LangChain.

---

4. Internal / Self-Hosted components (NOT outsourced)

The following components are internal: they run on hardware operated directly by Telos Intelligence LLC in Italy (EU) and do NOT constitute external Sub-Processors:

• PostgreSQL (database)
• Redis (cache, queue)
• Apache Kafka (federated event streaming)
• ChromaDB (vector store)
• OpenSwarm sidecar (execution layer), internal-only Docker network

---

5. Data Categories per Sub-Processor (Summary)

---

6. Right to Object

Under the main DPA §6.3, Customers have the right to lodge a reasoned objection to the addition/replacement of a Sub-Processor within 30 days of the notice.

How

• Email [email protected] with subject "Sub-Processor Objection";
• Specify: tenant identifier, the Sub-Processor being objected to, documented reasoning (e.g. specific request from the Customer's DPO, sector-specific compliance conflict).

Procedure

1. MARCØ evaluates the objection within 15 business days;
2. The Parties discuss in good faith to identify an alternative solution (e.g. channel-specific opt-out, BYOK, fallback Sub-Processor);
3. If no agreement is reached within 45 days of the original notice, the Customer may terminate the MSA with 30 days' notice, without penalties and with a pro-rata refund of prepaid fees.

---

7. Changelog

Future changes will be communicated with 30 days' notice via:

• Email to the Customer's privacy address (tenant.settings.privacy_email or fallback registration email);
• Update of this public page + API endpoint GET /api/v1/legal/sub-processors.

---

8. Contacts

For questions, clarifications or objections:

• Privacy and DPO email: [email protected]

---

9. Related documents

• Main DPA: docs/legal/DPA.md
• White-Label DPA cascade: docs/legal/DPA-WL.md
• Privacy Policy (EN): docs/PRIVACY_POLICY.en.md
• Terms of Service (EN): docs/TERMS_OF_SERVICE.en.md
• GDPR Compliance overview: docs/GDPR_COMPLIANCE.md
• DPIA: docs/DPIA.md

---

Public page updated 2026-05-18. Version 1.0. Change notice: 30 days before activation via email + changelog.