Mulno's own subprocessors
| Subprocessor | What it does for us | What it can see |
|---|
| Cloudflare, Inc. (USA; global network) | Runs the broker, the api, remote MCP and the lent-key service (Workers), their databases (D1), each project's session index (Durable Objects) and the queue that fills it (Queues), remote MCP connections (Workers KV), our request logs (Workers Logs), Mulno Cloud storage (R2), sends our sign-in, invite, plan-notice and beta-waitlist mail and the website's contact-form messages to us (Email Service, D133, D167, D179), and forwards mail to our contact addresses without storing it (Email Routing), and counts visits to www.mulno.com and measures how fast it loads (Cloudflare Web Analytics, D155) | Every request's connection metadata (IP address, approximate location); the broker and api's own records (see what we store); a recording's bytes, and the index derived from it, only for a Mulno Cloud project or a Private project's lent key |
Mulno's own mailbox (not a subprocessor of your testers' data)
| Vendor | What it does | What it sees | Its role |
|---|
| Google LLC (USA) | Mulno's mailbox (Gmail): mail to privacy@, security@ and developer@mulno.com is forwarded there and kept | What a person writes to those addresses | Provides the mailbox under its own terms. Mulno uses it only for its own correspondence, as a controller: studios and testers send requests about a playtest session (a deletion, a session id) through the product, not by e-mail (DPA §7(j)), so it is not a subprocessor under the DPA. Its EU-US Data Privacy Framework certification covers what reaches it from the EU and the UK. |
Mulno's own vendor for billing (not a subprocessor of your testers' data)
| Vendor | What it does | What it sees | Its role |
|---|
| Paddle.com Market Limited (and, for buyers in the US and Canada, Paddle.com Inc. and Paddle.com (Canada) Ltd, as Paddle's buyer terms say) | Merchant of record for paid plans (D129): the seller in law, handling checkout, invoicing, tax and refunds | A paying workspace's billing contact (the e-mail address we pass it when checkout opens) and whatever the buyer enters at Paddle's checkout — never a tester's or a session's data | The controller of buyer data it collects as merchant of record (its own privacy notice), and Mulno's processor for the e-mail address we send it (its data processing addendum). Neither is processing on a studio's behalf, so Paddle is not a subprocessor under the DPA; we list it for transparency. |
Not Mulno's subprocessors, but part of the picture
| Provider | Used for | Under whose account | Never Mulno's, because |
|---|
| OpenAI | Cloud speech-to-text (a mic track, transcribed on a reviewer's own request) | The studio's own account and API key | The studio instructs the provider directly, from its reviewer's own machine, never through our servers (D120). By OpenAI's own API terms it doesn't train on API data by default and keeps it up to 30 days to detect abuse |
| ElevenLabs | Same | Same | Same — and below its Enterprise plan it uses submitted audio to improve its models unless the studio opts out in its own ElevenLabs account settings (the opt-out covers new audio only), or is on Enterprise with training off |
| A reviewer's own AI assistant (Claude Code, claude.ai, ChatGPT, or another MCP client) | Reading and writing session notes and transcripts through mulno mcp | The reviewer's own account and plan with that provider | External agents run on the studio's own AI plan and cost us nothing but the read (D22, D89) |
What we don't use
The one analytics service is Cloudflare Web Analytics on www.mulno.com (D155), part of Cloudflare's row above: it uses no cookie or other browser storage, and Cloudflare says it doesn't fingerprint visitors or follow them from visit to visit with it. It sees a page view, the page and its referrer (without query strings), browser, operating system, device type, country, load timing and memory figures, and, like any request, the visitor's IP address; Cloudflare keeps its data in the United States. It never sees a recording, a session's data or anything else a studio keeps with us, and it isn't in the broker, the api, the app or Studio. No other analytics, advertising, error-tracking or support-chat vendor is wired into the broker or the api today. If one is added, it appears on this page with 30 days' notice before it processes any personal data on a studio's behalf.
Last updated 2026-10-08: Cloudflare's Email Service also sends the beta waitlist's e-mails, and its database (D1) keeps the waitlist (Mulno's own records as a controller, not a studio's data; see the privacy notice). Before that, 2026-10-05: it also sends the messages people write through the website's contact form to our own mailbox (Mulno's own correspondence, not a studio's data). Before that, 2026-10-03: it also sends the notice of a plan change that shortens how long a workspace keeps sessions. No subprocessor was added or replaced.