Mezantic Service Providers And Subprocessors
Version: 1.0
Effective date: 2026-05-15
Contact: hello@mezantic.com
1. How To Read This Document
1.1. This document lists service providers and sub-processors Mezantic uses to operate the service, within the meaning of Article 28(2) and (4) GDPR.
1.2. Sub-processor — provider that may process customer or respondent data (form content, responses, uploaded files, response metadata) on Mezantic's behalf.
1.3. Service provider — provider that supports Mezantic's operations (account, billing, security, communication, consent-activated analytics) without processing form content or respondent submissions.
1.4. Providers listed in section 4 are activated only after the user provides the required consent under Article 5(3) of Directive 2002/58/EC (ePrivacy) and the Cookie Policy.
1.5. Transfer mechanisms for data leaving the EEA. For transfers outside the EEA, Mezantic uses mechanisms permitted under Chapter V GDPR. Where a row lists multiple mechanisms (e.g., DPF and SCCs), they apply hierarchically under the provider's data processing agreement: the adequacy decision (DPF) applies first; if unavailable, the 2021 SCCs apply.
- EEA — processing within the EEA; no Chapter V mechanism required.
- DPF — adequacy decision under Article 45 GDPR (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023) for US recipients certified under the EU-U.S. Data Privacy Framework.
- SCCs — 2021 standard contractual clauses (Commission Implementing Decision (EU) 2021/914) under Article 46(2)(c) GDPR; Module 2 (controller → processor) or Module 3 (processor → processor), supplemented with additional safeguards where required.
- Art. 49 — derogations under Article 49 GDPR, used only in narrowly limited situations.
2. Core Sub-processors
Providers in this section process customer and respondent data on Mezantic's behalf as sub-processors.
| Provider | Legal entity and address | Purpose | Region / Transfer mechanism |
|---|---|---|---|
| Supabase | Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992 | Authentication, Postgres database, file storage | EEA (eu-west-1, Dublin) — Mezantic production project region; administrative-support transfers covered by SCCs (Module 3) under the Supabase data processing agreement |
| Vercel | Vercel, Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | Hosting, runtime, edge and server logs | EEA (fra1) primary; US transfers under DPF (Vercel, Inc. is DPF-certified) or SCCs under the Vercel data processing agreement |
| Google Generative AI / Gemini | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | AI-assisted form generation (PDF-to-Form, Prompt-to-Form) | EEA (Ireland) contracting entity; onward transfers to Google LLC (USA) under DPF or SCCs under the Google data processing agreement |
| Sentry | Functional Software, Inc. d/b/a Sentry, 45 Fremont St, 8th Floor, San Francisco, CA 94105, USA | Error monitoring and operational diagnostics | EU data residency (de.sentry.io); US transfers under DPF or SCCs under the Sentry data processing agreement |
3. Billing And Communication Providers
Providers in this section support Mezantic operations and do not process form content or respondent submissions.
| Provider | Legal entity and address | Purpose | Region / Transfer mechanism |
|---|---|---|---|
| Stripe | Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin D02 H210, Ireland | Payments, subscriptions, customer portal, payment events | EEA (Ireland) contracting entity; onward transfers to Stripe, Inc. (USA) under DPF or SCCs under the Stripe data processing agreement |
| Fakturownia | Fakturownia sp. z o.o., ul. Juliana Smulikowskiego 6/8, 00-389 Warsaw, Poland | VAT invoicing, KSeF, JPK_V7, tax/accounting records | EEA (Poland), no transfer outside EEA |
| Resend | Plus Five Five, Inc. d/b/a Resend, 2261 Market Street #5039, San Francisco, CA 94114, USA | Transactional email delivery | USA; DPF (Plus Five Five, Inc. is DPF-certified) or SCCs under the Resend data processing agreement |
4. Consent-Activated Providers
Providers in this section are activated only after the user provides the required consent (Article 5(3) ePrivacy, Article 6(1)(a) GDPR). Without consent, the provider does not process the user's data.
| Provider | Legal entity and address | Purpose | Region / Transfer mechanism |
|---|---|---|---|
| Vercel Speed Insights | Vercel, Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | Consent-activated Web Vitals and performance measurement | US transfers under DPF or SCCs under the Vercel data processing agreement |
| PostHog (EU) | PostHog, Inc., 2261 Market St #4008, San Francisco, CA 94114, USA | Consent-activated product analytics (events, account/workspace identifiers) | EU ingest region (eu.posthog.com); US support transfers under DPF or SCCs under the PostHog data processing agreement |
| Google Analytics / GA4 | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (EEA contracting entity); Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (affiliate) | Consent-activated analytics and campaign measurement; Consent Mode v2 required for EEA traffic | EEA (Ireland) contracting entity; onward transfers to Google LLC (USA) under DPF or SCCs under the Google data processing agreement |
| Meta | Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (EEA contracting entity); Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA (affiliate) | Consent-activated paid-media measurement (Pixel, CAPI); Meta and Mezantic may act as joint controllers for pixel data | EEA (Ireland) contracting entity; onward transfers to Meta Platforms, Inc. (USA) under DPF or SCCs under the Meta data processing agreement |
5. Updates And Objection
5.1. Mezantic updates this document when a provider is added, replaced, or removed, or when its role, processing region, or transfer mechanism changes.
5.2. Notice of an intended change to a sub-processor that may process respondent data is given at least 14 days in advance, in accordance with § 5 of the DPA.
5.3. Customer objections are handled under § 5 of the DPA, including the option to discontinue affected functionality or terminate the affected service.
5.4. Current document available at mezantic.com/en/legal/service-providers. Polish version: mezantic.com/pl/legal/service-providers.