Sub-processors

1. About this list

These are the third parties Mostly Tiny Ltd uses to process personal data on behalf of its business customers, under our Data Processing Agreement. Each is bound by data-protection terms no less protective than that agreement. Last updated: 2026-10-06.

2. Our sub-processors

Google Cloud and Firebase (Google) — MostlyQR — database (codes and destinations, hosted pages, form submissions, scan analytics and account records), server functions, and uploaded logos, images and print assets. Location: database in the EU (eur3 multi-region: Belgium and the Netherlands, with a witness replica in Finland); server functions in the UK (europe-west2, London); uploaded logos, images and print assets in the United States (us-east1).

Google Cloud and Firebase (Google) — MostlyPDF — database (account, usage and billing records), file processing, and the files you upload and their outputs. Location: database in the United States (nam5 multi-region); file processing, uploaded files and outputs in the UK (europe-west2, London).

Google Cloud and Firebase (Google) — MostlyRender — database (account, templates and usage records), rendering, uploads and rendered outputs. Location: database in the United States (nam5 multi-region); rendering, uploads and rendered outputs in the UK (europe-west2, London).

Google Cloud and Firebase (Google) — MostlyPrivacy — database (documents, websites, consent records and privacy requests), server functions, and stored files (document and consent-log exports, banner logos). Location: database in the United States (nam5 multi-region); server functions in the UK (europe-west2, London); stored files in the United States (us-east1).

Google Cloud and Firebase (Google) — Mostly Tiny ID — database (accounts, organisations, single sign-on and SCIM records, wallet ledger) and server functions. Location: database in the United States (nam5 multi-region); server functions in the UK (europe-west2, London).

Firebase Authentication (Google) — sign-in for every product (email address, sign-in records, and the IP address and browser used to sign in). Location: United States (Google runs it only in the United States).

Firebase Hosting (Google) — serving every product's website and app files (sees visitors' IP addresses). Location: Google's global network.

Stripe — payments and billing records for every paid product. Location: United States and EU.

Resend — transactional email (sign-in links, receipts, notifications) for every product. Location: United States.

Cloudflare — DNS, CDN and security; bot checks (Turnstile); approximate location for mqr.sh scan links; status.mostlytiny.io; hosting and storage for Vekta, the service behind MostlyQR's scan map. Location: global edge network.

PostHog (EU Cloud) — product analytics inside our apps, only with consent. Location: EU (Germany).

Fathom Analytics — cookie-free website statistics. Location: Canada (UK and EU adequacy decisions).

Anthropic — the MostlyPDF AI assistant (text is deleted within 30 days and not used for training). Location: United States.

Google Web Risk and Safe Browsing — malware and phishing checks on MostlyQR destinations (the destination address only). Location: United States.

3. Mostly Tiny services

Our products also use each other, all run by Mostly Tiny Ltd, with the locations given above: Mostly Tiny ID (sign-in, organisations and shared billing), MostlyRender (rendering PDFs and images for other products), MostlyPrivacy (consent banners and legal documents for our own sites) and MostlyQR (short links in MostlyRender templates). MostlyQR's scan map also uses Vekta, our map and location-data service, which runs on Cloudflare (listed above) and keeps each code's latest approximate scan location and a short trail of recent ones.

4. Recipients you choose

When you connect an integration — for example a webhook, or Meta's Conversions API in MostlyQR — we send data to that recipient on your instruction. It is your recipient, not our sub-processor.

5. Changes to this list

We give business customers at least 30 days' notice, by email and on this page, before we add or replace a sub-processor, and you may object as our Data Processing Agreement describes. To be told, make sure the billing email on your account is current, or ask us at privacy@mostlytiny.io.