Legal document
Sub-processors
The list is short: a hosting provider and an email provider. AI providers are deliberately not on it, and the reason why matters — it is not an omission.
Last updated 27 August 2026 · Governed by the laws of England and Wales
01Current sub-processors
These parties process personal data on our behalf and under our instructions, in connection with this website.
| Provider | What they do | Data involved | Location |
|---|---|---|---|
| Hostinger | Web hosting and the MySQL database behind this site | Everything the website stores: email addresses, names, support messages, pseudonymised IP hashes, user-agents, download records | EU / EEA data centres |
| Hostinger (SMTP) | Delivering transactional and release-note email | Email addresses and message contents we send you | EU / EEA |
That is the complete list for website data.
02Why AI providers are not sub-processors
When you use DAWN, substantial data goes to OpenAI, Anthropic, Google, or whichever provider you connected — including screenshots when Mac control is active. It would be reasonable to expect them on the list above. They are not, and the distinction is a real one rather than a convenience.
A sub-processor processes data on our behalf, under our instructions. That is not what happens here:
- You choose the provider. We do not select one for you.
- You hold the account and the credentials. We never see them.
- You pay them directly. No money passes through us.
- The connection is from your machine to theirs. Our servers are not in the path — we could not intercept it if we wanted to.
- We cannot instruct them, audit them, or delete your data held by them.
For the data you send through DAWN, you are the controller and your provider is your processor, under your agreement with them. We supply the software; we are not a party to that relationship.
The practical consequence is that you need to read your provider’s privacy terms yourself. We cannot make representations about them and will not pretend otherwise. The Privacy Policy sets out exactly what DAWN sends so you know what you are assessing.
03Incidental third parties
These are not sub-processors, but they are worth listing so this page is complete rather than merely accurate.
- Cloudflare
- DAWN requests a time sample from a public Cloudflare time service on start-up to check the beta expiry date. Cloudflare sees the originating IP address, as it would for any internet request. No personal content is transmitted, and no account or usage information is involved.
- Google Fonts
- Typefaces are downloaded from Google when we build the website and then served from our own server. Your browser never contacts Google. Google receives no data about visitors.
- Search engines (via DAWN)
- If you use DAWN’s web search, your query is passed to an intermediary library that queries several public search backends. This is initiated by you, from your machine.
04Configured but not in use
We are listing these because they exist in the code, even though nothing is currently sent to them. We would rather over-disclose here than have you discover an unlisted integration later.
- Mixpanel and PostHog
- DAWN contains adapters for both as optional product-analytics destinations. The feature is off by default and the shipped build has no delivery endpoint configured, so no data is transmitted to either. If that ever changes, this page and the Privacy Policy will be updated first, and the feature will remain opt-in.
05International transfers
Where a sub-processor processes personal data outside the UK, we rely on UK adequacy regulations or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as appropriate.
06Changes to this list
We will update this page before engaging a new sub-processor for personal data.
Business customers with a Data Processing Addendum in place can ask to be notified of changes in advance, and may object to a new sub-processor. Email support@maryalabs.io.