Last updated: 17 May, 2026
This document lists the third-party service providers ("subprocessors") that Launch Maniac LLC ("we," "us," "our") uses to operate Agency MCP. It is provided on request to customers and prospective customers under Privacy Policy §8.3.
If your use of Agency MCP requires a Data Processing Addendum (DPA), contact us at [email protected] to request one.
| # | Subprocessor | Purpose | Data categories processed | Location | Transfer mechanism |
|---|---|---|---|---|---|
| 1 | **Hetzner Online GmbH** | Application hosting (compute, networking, storage for the Agency MCP server) | Account information, GoHighLevel authorization information, Agency MCP authentication information, AI client and workflow agent information, usage data, billing event metadata | Germany (EU) | EU-resident processor; no cross-border transfer for this leg |
| 2 | **Neon, Inc.** | Managed Postgres database (encrypted-at-rest storage for tenants, tokens, bearer-token hashes, request_log, billing-event records) | All categories above, persisted to the relational store | United States | SCCs where applicable |
| 3 | **Cloudflare, Inc.** | DNS, edge tunnel (Cloudflare Tunnel from AUMA / Hetzner), DDoS protection, CDN for static dashboard assets | In-transit packet metadata (IP, TLS handshake, request paths). Does not persist payload contents. | Global edge network (closest POP to user) | SCCs where applicable |
| 4 | **Stripe, Inc.** | Payment processing, subscription management, billing webhooks, Stripe Checkout, Stripe Billing Portal | Billing information: customer identifiers, subscription identifiers, subscription tier, billing interval, billing contact information, billing address (where applicable), payment event metadata. Card details and bank account numbers are held by Stripe directly; Launch Maniac does not see or store them. | United States | SCCs where applicable |
| 5 | **Discord, Inc.** | Operational alerting webhook (server-side error events, install/uninstall notifications, deploy status). Receives only operational identifiers (tenant ID, company ID), error type, severity, and PII-scrubbed message strings. Does not receive customer CRM content. | Operational metadata only (no Customer Data; no personally identifiable contact information after scrubbing) | United States | SCCs where applicable |
If we add, remove, or replace a subprocessor, we will update this list. Material changes — those that could affect how your personal data is processed — will be communicated by email to account holders or via dashboard notice at least 30 days before taking effect, unless the change is required by an emergency or by law (in which case we will notify you as soon as practicable).
Customers and prospective customers may request the current version of this document at:
We will respond within 5 business days.