Sub-processors
Last Updated: 6 Oct 2026
To provide the Services, Mighty Workflow (Mighty Toolkit (Pty) Ltd) engages the third-party sub-processors listed below to process Customer Data on behalf of Subscribers. Each sub-processor is bound by data-protection obligations no less protective than those in our Data Processing Agreement (DPA).
| Sub-processor | Service / purpose | Data processed | Location |
|---|---|---|---|
| Hetzner | Hosting of the Mighty Workflow application, API, and database | Customer Data | European Union — Germany (eu-central) |
| Amazon Web Services (AWS) | File and object storage (S3) | Customer Data, including email attachments and uploaded documents | European Union — Ireland (eu-west-1) |
| Amazon Web Services (AWS) | Platform email delivery (SES): account verification, invitations, password resets, and notifications to Users | User names and email addresses; notification content, which can include workflow titles, thread subjects, and short excerpts of messages and comments | European Union — Ireland (eu-west-1) |
| Cloudflare | DNS, content delivery, and DDoS protection — all traffic to the Services passes through Cloudflare | All data in transit to and from the Services, including Customer Data and IP addresses | Global network (the Cloudflare data centre nearest the User) |
| Cloudflare | Encrypted storage of database backups | Customer Data (database backups) | Europe — Western Europe (WEUR) |
| OpenAI | AI processing of workflow emails to suggest to-dos, summarise workflows, and draft replies for a User to review | Email message content, workflow details, and to-dos (Customer Data) | United States |
Where a sub-processor processes Customer Data outside the European Union or South Africa, we implement appropriate safeguards (such as Standard Contractual Clauses or adequacy decisions), as described in Section 6 of the DPA.
We will email Workspace Owners at least 14 days before a new sub-processor starts processing Customer Data, giving you the opportunity to object, as set out in Section 5 of the DPA.
Merchant of Record
Subscription payments are handled by our Merchant of Record, Polar Software Inc. (United States). It is the legal seller of the Services, collects and processes payment details, and calculates and remits applicable taxes. It acts as an independent controller for payment data under its own privacy policy, not as our sub-processor. Details are set out in our Privacy Policy and DPA.
Services you choose to connect
The following services receive data only when a User chooses to connect them. Data reaches them at that User’s direction and under the User’s own agreement with the provider, so they are not our sub-processors.
| Service | What it’s used for | Data involved |
|---|---|---|
| Google sign-in | Optional sign-in with a Google account | We receive the name, email address, and profile image from your Google account |
| Google Calendar | Optional sync of your workflow and to-do deadlines to a calendar in your own Google account | Workflow and to-do titles (which you can choose to hide), descriptions, due dates, and links back to Mighty Workflow |
| Your email provider | The mailboxes a Workspace connects over IMAP/SMTP (for example Google Workspace or Microsoft 365), which send and receive workflow emails | Workflow emails and attachments, sent and received through the Subscriber's own mailbox |
| AI assistants | Optional connection of an AI app (such as Claude or ChatGPT) to your Workspace through our connector | Whatever the connected app requests on your behalf — workflows, emails, contacts, to-dos, and files you can access |