Sub-processors | Marlvel

1. What Is a Sub-processor

MARLVEL.AI is an AI intelligence layer and operating system for mobile app product managers (the apps Pulse, Pulse+ and Forge), delivered as a SaaS service moving from Private Beta to paid plans (Marlvel Pro, Max, Team and Enterprise). To run that service we rely on a small, carefully selected set of third parties.

A sub-processor is a third party engaged by us, acting as a data processor on our behalf, that may process customer personal data in the course of providing its service to us (for example hosting, analytics, error monitoring, AI inference or email delivery). We remain accountable to you for the personal data we process; sub-processors act only on our documented instructions and under a written contract that imposes data-protection obligations consistent with our own.

This page is maintained and kept up to date as part of our commitment to transparency. Where required, customers may object to a new or replaced sub-processor in accordance with the applicable Data Processing Agreement (DPA) — see "Notifications of Changes" below. We aim to publish sub-processor disclosures benchmarked against the commercial terms of providers such as Anthropic and OpenAI, while remaining a startup-lean operation.

2. Current Sub-processors

The following sub-processors may process customer personal data. For each, we list the provider name, the service or purpose, and the processing location together with the applicable cross-border transfer mechanism (Standard Contractual Clauses, "SCCs", and/or the EU–US Data Privacy Framework, "DPF").

Infrastructure & Hosting

Google Cloud Platform — hosting of the application and database (Cloud Run and Cloud SQL), storage and core infrastructure (primary region United States; SCCs / DPF).

Payments

Stripe — payment processing and billing (United States; SCCs).

Search & Data Retrieval

Brave Search (Brave Software, Inc.) — web search to answer in-product queries (United States; SCCs).
Firecrawl (Mendable, Inc.) — web content retrieval (United States; SCCs).

Product Analytics & Monitoring

PostHog — product analytics, feature flags and session recording (European Union; processed in the EU).
Amplitude — product analytics to understand feature usage (European Union; processed in the EU).
Sentry — application error monitoring and performance tracking (United States; SCCs).
Google Analytics 4 (Google LLC / Google Ireland Ltd) — event tracking for app performance insights (United States; SCCs / DPF).

AI & Large Language Model Providers

Anthropic — large language model provider for AI features (United States; SCCs — does not train on customer data under its commercial / API terms).
OpenAI — large language model provider for AI features (United States; SCCs — does not train on customer API data under its commercial / API terms).
Google (Gemini) — large language model provider for AI features (United States; SCCs / DPF).
Mistral AI — large language model provider for AI features (European Union (France); processed in the EU).
LangSmith (LangChain, Inc.) — AI tracing and observability (debugging and quality monitoring) (United States; SCCs).

Communications

Resend — transactional and account email delivery (United States; SCCs).
Slack (Salesforce, Inc.) — workspace messaging integration and operational alerting (United States; SCCs).
Meta Platforms, Inc. / WhatsApp Cloud API — messaging delivery for users who connect via WhatsApp (United States; SCCs).

All sub-processors are bound by written data-protection terms and adhere to recognised security standards (for example SOC 2 and GDPR, where applicable). Where personal data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework to ensure an adequate level of protection.

3. Geographic Scope & Export Restriction

The Service is offered to customers worldwide, with one exception:

The Service is not offered to users located in mainland China (CN). We do not knowingly provide the Service to, or process personal data on behalf of, users in mainland China, and our sub-processors are not engaged to serve that territory.

This restriction applies in addition to any applicable export-control and sanctions rules. The Service and its sub-processing arrangements are designed for processing primarily within the European Union and the United States, as described in Section 2.

4. Data Controller, Publisher & Host

The Service is published and operated by:

MARLVEL.AI, a French société par actions simplifiée (SAS) with a share capital of 5,000 €.
SIREN: 993 573 666 — registered with the RCS de Lyon.
VAT number: FR56993573666.
Registered & contact address: 254 Rue Vendôme, 69003 Lyon, France.
Director of publication / President: Jérôme VUILLEMOT.
Legal contact: legal@marlvel.ai.

Hosting

The Service is hosted on Google Cloud. The EU contracting entity is:

Google Cloud EMEA Limited — Velasco, Clanwilliam Place, Dublin 2, Ireland.

This page and the underlying contractual relationship are governed by French law. Subject to any mandatory consumer-protection rules, the courts of Lyon have jurisdiction over any dispute. Our processing practices are designed to be aware of, and consistent with, the EU General Data Protection Regulation (GDPR) and the EU AI Act.

5. Notifications of Changes

We may add, replace or remove sub-processors as our service evolves. When we do, we keep this page current and, where required by the applicable Data Processing Agreement, we provide advance notice of any intended addition or replacement of a sub-processor that may process customer personal data.

How we notify: by updating this page and, for material changes affecting customers under a DPA, by reasonable advance notice through the contact channel on file.
Right to object: customers may object to a new or replaced sub-processor on legitimate, data-protection-related grounds, in accordance with the terms and timelines set out in their DPA.
How to object or ask questions: contact us at legal@marlvel.ai. We will work in good faith to address reasonable objections; where an objection cannot be resolved, the remedies set out in the DPA apply.

To stay informed of changes, we recommend reviewing this page periodically. The current status is reflected in the "Last Updated" note below.

6. Last Updated

This Sub-processors list is reviewed and maintained on an ongoing basis. The list in Section 2 reflects the sub-processors engaged as of the date shown below.

Last updated: 30 June 2026.
Maintained by: MARLVEL.AI — legal@marlvel.ai.

For any question about this list, our sub-processors, or our Data Processing Agreement, contact legal@marlvel.ai.