MCP1. Scope and service provider
This register describes the providers used or expected to be used in delivering Growwwy MCP, operated by Media&Business Consulting Kft., 1037 Budapest, Harang utca 12., Hungary (company registration no. 01-09-989825, tax no. 24086844-2-41). Contact: elemer@growwwsites.com.
The list covers third parties that process Customer Personal Data on behalf of Growwwy as subprocessors. It separately explains providers that operate as independent controllers or are selected by Customers. The classification depends on the specific data flow and the applicable contractual terms; a vendor can hold different roles for different purposes.
Current status: The core providers below are supported by the known deployment setup and vendor documentation. This register remains provisional until the actual infrastructure hosting contract, legal entity, location and applicable DPAs are verified.
2. Growwwy subprocessors — currently identified
| Provider / legal entity | Function in Growwwy | Categories of data potentially processed | Region / transfer notes | Verification |
|---|---|---|---|---|
| Cloudflare, Inc. | CDN, reverse proxy, HTTPS/network protection and security filtering for the service domains, where enabled | Network identifiers, IP addresses, request metadata, URLs and potentially HTTP traffic routed through its service | Global infrastructure; cross-border processing may occur; governed by Cloudflare DPA and applicable transfer safeguards | Identified; confirm exact products, account settings and current contract |
| Plus Five Five, Inc. (Resend) | Transactional email delivery for account verification, invitations and password reset | Recipient address, sender, message content, delivery metadata, potentially IP/address logs associated with provider operations | United States storage according to Resend; SCCs and further measures in its DPA | Identified; verify that the current account has accepted provider DPA |
The table is not a claim that all hosting, monitoring and administrative vendors have already been verified. Subprocessors employed by the above vendors are governed by their own maintained lists and contractual terms; they are not automatically each a direct subprocessor appointed by Media&Business Consulting Kft.
Official vendor documentation: Cloudflare DPA · Cloudflare subprocessors · Resend DPA · Resend subprocessors.
3. Hosting and infrastructure — confirmation required
The Growwwy MCP deployment is managed through NovaPanel, and the application uses Node.js/PM2 and a reverse proxy. NovaPanel is an administrative panel, not evidence of the data-centre operator's legal identity.
Before publishing this register as complete, the Provider must identify and record:
- The actual legal entity supplying the VPS/server and any backup infrastructure;
- Its registered country and the actual server/data storage region;
- The types of Customer Personal Data stored or accessible to it, including encrypted credential stores, backups and logs;
- Its applicable Data Processing Agreement, subprocessor list and international transfer mechanism, if required.
Until confirmed, this is an outstanding mandatory register entry, not an assertion that the hosting service has no access to Customer Personal Data.
4. Other vendors and independent processing roles
The following services may handle personal data but are not automatically included as Growwwy's subprocessors in respect of Customer-connected marketing data:
| Party | Context | Expected role / note |
|---|---|---|
| Stripe / applicable Stripe Managed Payments entity | Subscription Checkout, payment method, merchant-of-record transactions, tax, fraud and billing administration | Stripe's role varies by operation. For Managed Payments it can act as merchant of record and independent controller for specified transaction purposes. For other Stripe account operations it can act as processor. Its separate DPA and terms control; confirm the live arrangement rather than classifying every Stripe processing operation as a Growwwy subprocessing activity. |
| Google, Meta, TikTok, Shopify, BigCommerce, WooCommerce and similar connected platforms | Data requested through Customer-authorised accounts | Generally direct, Customer-selected platform relationships; not appointed solely through Growwwy integration as Growwwy subprocessors. Their own controller/processor status depends on the platform and customer agreement. |
| OpenAI ChatGPT, Anthropic Claude, Google Gemini or other selected AI assistant | Customer chooses an AI client to connect to Growwwy MCP and receive permitted responses | A Customer-selected downstream recipient; processing relationship is governed by the Customer's arrangement with that AI provider. Do not imply that Growwwy itself engages an LLM subprocessors for every customer connection. |
If Growwwy starts directly sending Customer Personal Data to an AI model or other vendor on its own behalf, this register and the applicable DPA must be reviewed before such processing begins.
5. International transfers and security
Where processing results in a GDPR-restricted transfer outside the EEA, the Provider must ensure an appropriate Chapter V mechanism, such as an adequacy decision or executed EU Standard Contractual Clauses (Decision 2021/914), as applicable. General claims of EEA-only data storage must not be made while the hosting region remains unverified and Resend confirms US storage.
Cloudflare and Resend publish provider DPAs and further security/transfer information. The Provider should retain evidence of the actual vendor contracting entities and executed or accepted DPAs for the Growwwy account.
6. Proposed addition, replacement and objection procedure
Subject to incorporation into an executed Growwwy DPA, Customers would give general authorisation for necessary subprocessors and be notified via their registered workspace administrator email at least 30 calendar days before a planned material addition or replacement. Customers would have 15 calendar days to object on documented data protection grounds. Proposed changes and responses should be recorded, and an unresolved objection should be handled under the executed DPA.
Operational dependency: A reliable change-notification procedure and owner for the subprocessor register must be established before publishing these time limits as a final commitment. The provider should maintain version history and archived editions of this register.
7. Contact, versioning and outstanding verifications
Version: 2026-10-29 (draft). For enquiries and proposed objections, contact elemer@growwwsites.com.
Before production publication, confirm the hosting company and data-centre location; verify Cloudflare and Resend contracts and data flows; document backup retention and access; decide if any additional monitoring, support, email or analytics processors actually handle Growwwy Customer Personal Data; and implement the planned change notice process.
Related documents: Data Processing Agreement, Terms & Conditions, Privacy Policy.