Last updated: 10 August 2026
Sub-Processors
Morv AI Ltd uses the following sub-processors to provide our services. This page is maintained in accordance with our Data Processing Agreement.
We will update this page and notify affected users by email at least 14 days before adding or replacing a sub-processor.
Infrastructure
| Sub-Processor | Purpose | Data Processed | Location | Safeguards |
|---|---|---|---|---|
| Cloudflare, Inc. (CDN, WAF and DDoS protection) | Content delivery, web application firewall, DDoS mitigation and TLS termination for all traffic to this platform | All request data in transit: IP address, URL, request headers, and request/response content (including chatbot messages) | Global edge network (UK and EU visitors are served from local data centres) | Cloudflare DPA (incl. UK Addendum) |
| Hostinger | Server hosting and data storage (virtual private server) | All platform data (account data, conversations, knowledge base, logs) | United Kingdom | Hostinger DPA |
| SMTP2GO | Transactional email delivery | Recipient email addresses, names, email content | European Union (EU data region) | SMTP2GO DPA |
AI Providers
| Sub-Processor | Purpose | Data Processed | Location | Safeguards |
|---|---|---|---|---|
| OpenAI, Inc. | AI response generation | Chatbot messages, conversation context, knowledge base excerpts | United States | OpenAI DPA (incl. UK Addendum); API data not used for training |
| Google LLC (Gemini) | AI response generation | Chatbot messages, conversation context, knowledge base excerpts | United States | Gemini API Additional Terms of Service (paid tier — prompts and responses are not used to improve Google’s products), UK IDTA |
Payment and Security
| Sub-Processor | Purpose | Data Processed | Location | Safeguards |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing | Payment details, email, billing address | United States | Stripe DPA (incl. UK Addendum), PCI DSS Level 1 |
| Google LLC (reCAPTCHA v3) | Bot detection on our public website’s forms (registration, log-in, partner and contact forms). The reCAPTCHA script loads when a visitor first interacts with any form, or opens the sign-up/log-in dialog, on any public page, and sends the visitor’s IP address and browser signals to Google at that point. | IP address, device/browser metadata | United States | Google Privacy Policy and Google Controller-Controller Data Protection Terms, UK Addendum |
| Cloudflare, Inc. (Turnstile) | Bot detection on chatbot widget (optional, per chatbot configuration) | IP address, device/browser metadata | Global edge network (UK and EU visitors are served from local data centres) | Cloudflare DPA (incl. UK Addendum) |
| Google LLC (Google Analytics 4) | Consent-gated website and dashboard usage analytics (never the embeddable chatbot widget) | Usage data: pages visited, interaction events, approximate location (from IP), device/browser metadata | United States | Google Ads Data Processing Terms (covers Google Analytics), UK Addendum |
Customer-Initiated Integrations
When you connect a third-party integration, data from your chatbot conversations may be shared with that service’s API. These are initiated by your configuration and processed under your agreement with the third-party service. Available integrations include:
| Service | Data Shared | Privacy Policy |
|---|---|---|
| Shopify | Search queries, product/order lookups from conversation context | Shopify Privacy |
| Magento (Adobe Commerce) | Search queries, product/order lookups from conversation context | Adobe Privacy |
| Guesty | Search queries, listing/availability lookups from conversation context | Guesty Privacy |
| WooCommerce | Search queries, product/order lookups from conversation context | Self-hosted on your own WordPress site — no third party receives this data |
| Square (Square Online / Weebly) | Search queries, product and order lookups from conversation context | Square Privacy Notice |
These integrations are not sub-processors under the DPA because the data flow is between you (the Controller) and the third-party service under your existing agreement. Morv facilitates this connection as part of the Service.
Changes
| Date | Change |
|---|---|
| 11 April 2026 | Initial sub-processor list published |
| 8 July 2026 | Rebranded to Morv AI Ltd; corrected email provider (SMTP2GO, EU region); added Magento (Adobe Commerce) to customer-initiated integrations |
| 4 August 2026 | Added Google LLC (Google Analytics 4) — consent-gated site analytics |
| 10 August 2026 | Corrected the hosting provider to Hostinger (United Kingdom); corrected the Google Gemini entry to the Gemini API Additional Terms of Service; removed integrations that are not yet available |
| 20 August 2026 | Added WooCommerce to customer-initiated integrations |
| 25 August 2026 | Added Square (Square Online / Weebly) to customer-initiated integrations |
Objections
If you wish to object to a new sub-processor, contact us at privacy@morv.ai within 14 days of receiving the change notification. See our Data Processing Agreement Section 4 for the objection process.