Subprocessors

The following processors handle personal data on behalf of Moshi Inc. We will update this list before adding or replacing a subprocessor.

Purpose: Image storage (R2), structured data (D1), edge compute (Workers), key-value cache (KV), CDN delivery, and background bot protection on sign-in and signup forms (Turnstile).
Data: All categories of personal data we process — encrypted at rest and in transit. For bot protection, Turnstile evaluates request signals (IP address, TLS fingerprint, user agent) in the background without setting cross-site cookies; see Cloudflare's Turnstile Privacy Addendum.
Region: Global edge network; primary data residency in the United States.
Transfer mechanism (EU/UK): EU–U.S. Data Privacy Framework + Standard Contractual Clauses.
DPA: Cloudflare Data Processing Addendum (v6.4, effective 3 April 2026).

Purpose: Transactional email delivery (SES) and automated content-safety classification of uploaded images (Rekognition).
Data: Recipient email address and message content for SES; downscaled image bytes for Rekognition (not retained for training).
Region: us-east-1 (United States).
Transfer mechanism (EU/UK): EU–U.S. Data Privacy Framework + Standard Contractual Clauses.
DPA: AWS GDPR DPA + UK GDPR Addendum, auto-applied via the AWS Customer Agreement.

Purpose: Payment processing for paid subscriptions; fraud screening; tax computation and collection (Stripe Tax) including EU VAT.
Data: Billing name, address, and payment-method data — collected directly by Stripe; we never see card numbers.
Region: United States and Ireland.
Transfer mechanism (EU/UK): Standard Contractual Clauses.
DPA: Stripe Data Processing Agreement (18 November 2025).

Purpose: Privacy-respecting, cookieless web analytics.
Data: Aggregated, non-identifying event data; no cookies, no cross-site tracking.
Region: European Union (Estonia / Germany).
Transfer mechanism (EU/UK): EU-based; no third-country transfer needed.
DPA: Plausible Data Processing Agreement (last updated March 2026).

Purpose: Lifecycle and product-update email (only with consent where required).
Data: Recipient email address, name, and subscription state.
Region: United States (and other locations where Flodesk or its sub-processors operate).
Transfer mechanism (EU/UK): Standard Contractual Clauses.
DPA: Flodesk Data Processing Addendum (version 27 May 2026). Contracting entity is Flodesk, Inc.

Purpose: Server-side conversion measurement for paid acquisition (Reddit Conversions API).
Data: SHA-256-hashed email (never plaintext), IP address, browser user agent, Reddit's ad-click identifier, and event metadata for users who arrived via Reddit ads.
Region: United States.
Transfer mechanism (EU/UK): Standard Contractual Clauses.
DPA: Reddit Advertising Data Processing Agreement (effective 7 August 2025), auto-applied via the Reddit Advertising Services Agreement. Reddit's own subprocessor list: Reddit Ads Subprocessors.