Subprocessors
Last updated: [date]
Moonlight Array B.V.
Draft pending verification
This list is a starting point and must be verified against the actual processing stack before publication. Each entity, purpose, location, and transfer mechanism — and any bracketed item [like this] — must be confirmed.
Moonlight Array B.V. ("we", "us") engages the third-party subprocessors listed below to help provide AIDO (the "Service"). This page is referenced by our Privacy Policy and our Data Processing Agreement. Each subprocessor is bound by a written contract imposing data protection obligations no less protective than those in our DPA, to the extent applicable to the services it provides.
Where a subprocessor processes Personal Data outside the European Economic Area, the transfer is made under an appropriate Chapter V GDPR safeguard (an adequacy decision, Standard Contractual Clauses, and/or the EU-U.S. Data Privacy Framework), supplemented by additional technical and organisational measures where required by a Transfer Impact Assessment.
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Scaleway SAS | Cloud hosting, compute, container registry, and provisioning of Hosted Instances | France (EU) | N/A — processing within the EEA |
| Cloudflare, Inc. | DNS, CDN, TLS termination, DDoS mitigation, and edge security | United States / global | SCCs + EU-U.S. Data Privacy Framework |
| Anthropic PBC | Large language model inference (Agent reasoning and outputs) | United States | SCCs / EU-U.S. Data Privacy Framework |
| [Additional AI / model providers] | Large language model inference where configured by the user | [location] | [SCCs / DPF / adequacy] |
| [Stripe / Mollie] | Payment processing, billing, and invoicing | [Ireland / United States / Netherlands] | [Intra-EU / SCCs / DPF] |
| Scaleway TEM | Transactional and administrative email delivery | France (EU) | N/A — processing within the EEA |
| [Analytics / monitoring / error-tracking provider] | Usage analytics, error tracking, and service monitoring | [location] | [transfer mechanism] |
Changes to this list
For business customers who have entered into a Data Processing Agreement with us, subprocessor additions or replacements are notified and managed in accordance with that agreement, including your right to object on reasonable, substantiated data-protection grounds within the applicable notice period. To request notification of subprocessor changes or a copy of the safeguards we rely on, contact [[email protected]].