Subprocessors
Last updated: 3 July 2026
About This Page
To operate MASK, we rely on a small number of third-party service providers ("subprocessors") that may process personal data on our behalf. This page lists the subprocessors we use, what they do, and the region in which they primarily operate.
This page should be read together with our Privacy Policy. Regions reflect each provider's primary operating locations and may vary; some providers operate globally.
Current Subprocessors
| Provider | Purpose | Region |
|---|---|---|
| Vercel | Application hosting, content delivery (CDN), edge routing, and scheduled jobs. | Global (US primary) |
| Supabase (PostgreSQL & storage) | Primary database and file/object storage for platform data. | Operator-managed |
| Stripe | Subscription and add-on (expansion pack) payment processing. Card details are held by Stripe, not by MASK. | Global (US / EU) |
| Google (reCAPTCHA) | Bot and abuse protection on public forms (sign-up, login, magic link, contact, enterprise contact, founding creators), when enabled. Receives IP address and interaction signals. | Global (US) |
| Transactional email provider (Resend or Amazon SES, as configured) | Delivery of our own transactional email, such as account and security notifications. | US (configurable) |
| Third-party AI processing provider | Generates Mask AI bio-page copy and CV Maker drafts from the text a user submits, when the feature is used. Input is not used to train the provider's models. | US |
| PayPal | Remitting Affiliate Programme commission payouts when a participant selects PayPal. | Global |
| Wise | Remitting Affiliate Programme commission payouts when a participant selects Wise. | Global |
Providers You Configure
Some services send data to third parties only because you choose to connect or configure them. These are controlled by you, under your own agreement with the relevant provider, and are not MASK subprocessors:
- Email broadcast providers. Email campaigns you send to your own subscribers are delivered through the SMTP server or email service provider (for example SendGrid, Mailgun, Brevo, or Resend) that you supply and configure. You own those credentials and are bound by that provider's terms.
- SMS provider (Food Orders). If you turn on SMS order updates, status texts are sent through the Twilio account that you supply and configure. The customer's phone number and order status are shared with Twilio to deliver the message. You own those credentials and are bound by Twilio's terms.
- Integrations. When you connect integrations such as Slack, Zapier, webhooks, or a connected Stripe account, data flows to the systems you designate. You are responsible for those systems.
Changes
We may add or replace subprocessors as the platform evolves. Material changes will be reflected here with an updated "last updated" date. For questions about our subprocessors, contact privacy@mask.pk.