Sub-processor Register

Published at: www.metadat-ai.com/legal/sub-processors

Document reference: MAI-SPR-001 Version: v1.4 Last updated: November 2026 © METADAT-AI LTD (Company No. 17486598)


This is the Sub-processor Register referred to in clause 4.4 of the Metadat-AI Data Processing Agreement (DPA). It lists the third parties that METADAT-AI LTD (“Metadat-AI”) engages to process customer personal data when acting as a processor. It is a living document: Metadat-AI will give customers at least thirty (30) days’ prior written notice of any intended addition or replacement of a Sub-processor in accordance with clause 4.5 of the DPA, and customers may object as set out in clause 4.5 of the DPA.

This is the Sub-processor Register referred to in clause 4.4 of the Metadat-AI Data Processing Agreement (DPA). It lists the third parties that METADAT-AI LTD (“Metadat-AI”) engages to process customer personal data when acting as a processor. It is a living document: Metadat-AI will give customers at least thirty (30) days’ prior written notice of any intended addition or replacement of a Sub-processor in accordance with clause 4.5 of the DPA, and customers may object as set out in clause 4.5 of the DPA.


It lists only the third parties that process customer personal data on the Metadat-AI platform.

1. Current Sub-processors


Sub-processor	Processing location	Purpose	Transfer safeguard (UK GDPR)
Amazon Web Services EMEA SARL (Luxembourg)	Ireland, EU (AWS eu-west-1, Dublin)	Cloud infrastructure for the Software: compute (EC2), object storage (S3), DNS (Route 53), monitoring and logs (CloudWatch) and transactional email (SES), including processing of Customer Content where Metadat-AI hosts the processing, and storage of galleries and Embeddings where the customer chooses Metadat-AI storage	None required: Ireland is covered by UK adequacy regulations
MongoDB, Inc. (United States): MongoDB Atlas	Ireland, EU (Atlas cluster hosted in AWS eu-west-1)	Application database and operational logging (application settings, API usage logs and operational data)	Data hosted in Ireland. Any access from the United States is covered by the EU Standard Contractual Clauses with the UK Addendum or another transfer mechanism permitted by the DPA
Microsoft Ireland Operations Limited: Microsoft 365	EU (Microsoft EU Data Boundary)	Business email and document storage (OneDrive) used for customer support correspondence. Processes only the personal data that a customer chooses to include in support correspondence	None required (UK adequacy)
Anthropic, PBC (United States): Claude	United States	AI assistant used by Metadat-AI personnel for operational and back-office work: reviewing code, investigating system logs, maintaining customer relationship (CRM) records and handling business email. This may involve limited personal data (such as names, contact details, IP addresses and the content of correspondence). Customer Content, Facial Data and Embeddings held in the Platform are never sent to it	EU Standard Contractual Clauses with the UK Addendum, under Anthropic's data processing terms
Mediate Solutions Ltd (United Kingdom)	United Kingdom	Software development, maintenance and support services, including access to production systems where necessary. Mediate Solutions Ltd engages Butalia Media to provide development personnel	None required (UK)
Butalia Media (United States and India), engaged through Mediate Solutions Ltd	United States (Los Angeles) and India, by remote access to production systems hosted in AWS eu-west-1	Software development, maintenance and technical support, including access to production data (which may include Customer Content and biometric data) where necessary	EU Standard Contractual Clauses (Module 3) with the UK Addendum
Google LLC (United States): Google Gemini API	United States	AI-assisted processing of support tickets sent to Metadat-AI’s support channels. Processes only the personal data that a customer chooses to include in support correspondence (such as names, contact details and descriptions of issues). Customer Content, Facial Data and Embeddings held in the Platform are never sent to it	EU Standard Contractual Clauses with the UK Addendum, under Google’s data processing terms
SpaceXAI LLC (United States): xAI Grok API	United States	AI assistant used by Metadat-AI personnel for back-office work: maintaining customer relationship (CRM) records and handling business email. This may involve limited personal data (such as names, contact details and the content of correspondence). Customer Content, Facial Data and Embeddings held in the Platform are never sent to it	EU Standard Contractual Clauses with the UK Addendum, under xAI’s data processing terms

2. Where Customer Data Is Processed

Default: the customer stores and processes its media, search data, galleries, Facial Data, Embeddings and AI Output in its own environment (cloud or on-premises), which it controls. No Sub-processor processes that data.

Metadat-AI hosting or storage: where the customer chooses either, customer data (including logs) is stored and processed by Metadat-AI in AWS (currently eu-west-1, Ireland) or on Metadat-AI's own equipment at its office in London, which is Metadat-AI's own premises and not a Sub-processor. Metadat-AI's development, demonstration and trial environment is at the same office and processes customer personal data only for authorised trials and demonstrations under the Demonstration and Trial Policy. Vector search runs on software that Metadat-AI hosts itself; the software vendor has no access to customer data. Metadat-AI personnel access these systems from the United Kingdom; transfers from the EEA to the United Kingdom rely on the European Commission's adequacy decision for the United Kingdom.

Services the customer connects: AI services or other tools that the customer connects with its own account or API key (for example through Metadat-AI's skills, an MCP connection or the API) act for the customer and are not Metadat-AI's Sub-processors. Sending customer data or metadata to them is never the default and happens only when the customer enables it.

AI tools used by Metadat-AI: Metadat-AI uses AI tools only for operational and back-office work. Customer media, Facial Data and Embeddings are never sent to them.

3. Biometric Data

Where a Sub-processor hosts or processes Facial Data or Embeddings (as defined in the Biometric and Facial Recognition Processing Addendum), Metadat-AI requires it to process that data only to provide the Services and under written terms that meet Article 28 of the UK GDPR. Infrastructure providers (AWS and MongoDB) host it under their standard data processing terms. Metadat-AI requires its development and support Sub-processors to accept obligations equivalent to clause 5 of that Addendum (purpose limitation, no model training, segregation, security and access restriction).

4. Notifications of Changes

Metadat-AI notifies customers of changes to this Register by email to the contact named in the customer's Order Form. Customers who buy through a Reseller are notified through the Reseller and at the email address in their Reseller Customer Order Form. Anyone may ask to receive notifications by emailing legal@metadat-ai.com with the subject line “Sub-processor notifications”.

5. Change Log


Date	Change
October 2026	Register first published. Added Microsoft Ireland Operations Limited (Microsoft 365), Mediate Solutions Ltd and Butalia Media.
October 2026 (v1.1)	Butalia Media transfer safeguard restated as EU Standard Contractual Clauses (Module 3) with the UK Addendum. Processing locations clarified (production in AWS eu-west-1).
October 2026 (v1.2)	Development, demonstration and trial environment described (Metadat-AI’s own premises, not a Sub-processor). Biometric terms for Sub-processors restated. Processing locations simplified (customer environment by default; AWS or Metadat-AI's London office where chosen); AWS services combined into one entry; Anthropic (Claude) added; customer-connected services explained.
October 2026 (v1.3)	Name of the vector search software removed from the description. It is self-hosted by Metadat-AI and its vendor has no access to customer data, so it is not a Sub-processor.
November 2026 (v1.4)	Google LLC (Google Gemini API) added as a Sub-processor for AI-assisted processing of support tickets. SpaceXAI LLC (xAI Grok API) added as a Sub-processor for CRM records and business email. Anthropic (Claude) purpose extended to CRM records and business email. Transfer safeguard for both additions: EU Standard Contractual Clauses with the UK Addendum.

MAI-SPR-001 v1.4. © METADAT-AI LTD (Company No. 17486598). This Register is incorporated by reference into the Metadat-AI Data Processing Agreement. Questions: legal@metadat-ai.com.