monkeymachine™ — SUB‑PROCESSORS

A sub-processor is a third party engaged by us that processes personal data on our instructions while we provide the Service. A data processing agreement is in place with each of them.

This register does not include messengers and social networks (WhatsApp, Telegram, Instagram, VKontakte and others) connected by the Customer. Accounts with those services are created by and belong to the Customer, and the Customer's relationship with their operators is governed by those services' own terms and policies, accepted by the Customer when the account was created. The Platform merely displays the connected channel's conversations in the operator workspace and processes them on the Customer's instructions — see Section 5 of the Privacy Policy.

The infrastructure on which we store data (database servers, object storage, backups) and our error tracking system are operated by us and located in the Russian Federation; that data is not disclosed to third parties.

Cloudflare, Inc. — DNS zone management and inbound email routing for Customers' own domains. Processes domain records and email routing attributes.

YooMoney for Business (YooKassa) — card acquiring, payment processing, fiscal receipts.

Tochka Bank — SBP acquiring, settlement services.

Notisend — transactional and marketing emails.

OpenAI, Anthropic, Google AI, OpenRouter (aggregator) and other providers engaged through Platform routing for speech recognition, image generation and other AI features. The current composition is available on request at privacy@monkeymachine.ru.

Training on Customer content: only with explicit opt-in; all providers are contractually bound not to use Customer or End User data for model training without the Customer's explicit consent. Data sent is minimised to what the specific task requires.

The Platform integrates with external CRM and business automation systems to synchronise client data, appointments, orders and other information on the Customer's instructions. Integration is enabled solely at the Customer's initiative and in the Customer's interest.

YCLIENTS (LLC "UYCLIENTS") (INN 7707784510, OGRN 1127747001498) — synchronization of client data (name, phone, email), service appointments, services and categories, staff and schedules. YCLIENTS acts as an independent data operator (registered with the Roskomnadzor register of personal data operators). monkeymachine™ processes the received data solely on the Customer's instructions (Art. 6(3) of Federal Law No. 152-FZ). Data is stored in the Russian Federation.

RetailCRM (LLC "Retail Soft") (INN 7726680827) — synchronization of orders, customer records (name, phone, email, delivery address) and processing statuses. RetailCRM acts as an independent data operator. Data is stored in the Russian Federation.

Other accounting and merchandise systems (including 1C, MoySklad, iiko, marketplaces and delivery services) are connected by the Customer independently and in the Customer's interest; each such system acts as an independent operator with respect to data held in it. The list of systems connected in a given project is available to the Customer in the control panel.

General principles for integration data:

• An integration is enabled solely by the Customer's decision and may be disabled at any time from the project control panel;
• The scope of transferred data is determined by the integration settings chosen by the Customer;
• The Customer, being the operator with respect to its own clients, independently ensures the legal grounds for transferring personal data between systems, including obtaining data subject consents;
• monkeymachine™ does not determine its own purposes for processing data received from such systems — processing is carried out solely within the Customer's instructions;
• When an integration is disabled, synchronisation stops; previously synchronised data remains in the Customer's account until deleted by the Customer or until the account is terminated;
• API keys and authorisation tokens are stored encrypted and are not disclosed to third parties.

The Platform does not attach its own advertising or analytics counters to Customers' websites. A Customer may connect a third-party web analytics service (for example, Yandex Metrica) on its own; in that case the Customer acts as the operator with respect to the data collected by that service and is responsible for obtaining visitor consent through the cookie consent banner.

We notify Customers at least 30 days before engaging a new sub-processor or materially changing the scope of processing by an existing one. The Customer may object to a proposed change; where technically feasible we will disable the relevant sub-processor for the objecting Customer without impairing core Service functionality.