Last updated: March 18, 2026
This page lists the third-party sub-processors that Quadrate28 DMCC (doing business as Mokko) uses to provide the Services described in our Privacy Policy and Terms of Service. Each sub-processor has been evaluated for appropriate data protection practices.
| Sub-processor | Entity | Purpose | Data Processed | Location |
|---|---|---|---|---|
| Anthropic | Anthropic, PBC | Large language model (LLM) processing for AI-powered design assistance, including interpreting your design system and generating design recommendations | Figma design data (layers, styles, components), user prompts, usage history | United States |
| OpenRouter | OpenRouter, Inc. | API routing layer used to access the Black Forest Labs image generation model | Image generation prompts, API metadata | United States |
| Black Forest Labs | Black Forest Labs GmbH | AI image generation model, accessed through OpenRouter, used to create design assets on your behalf | Image generation prompts, generated image outputs | Germany / United States |
| Sub-processor | Entity | Purpose | Data Processed | Location |
|---|---|---|---|---|
| DigitalOcean | DigitalOcean, LLC | Cloud hosting (App Platform) for the Mokko backend application and API servers; object storage (Spaces) for AI-generated images and user-uploaded files (design assets, documents) | All service data transmitted through or stored by the Services (account information, usage data, Figma design data, AI-generated images, user-uploaded files and associated metadata) | Germany (EU) |
| Sub-processor | Entity | Purpose | Data Processed | Location |
|---|---|---|---|---|
| LangSmith | LangChain, Inc. | AI telemetry, evaluation, and monitoring platform used to assess and improve the quality of AI-generated outputs (EU data residency) | User interaction data, Figma design data sent for processing, AI model inputs and outputs, performance metrics | European Union |
| Mixpanel | Mixpanel, Inc. | Product analytics for the Figma plugin (not used on the mokko.ai website), configured with automatic event capture and heatmap recording | Click events, form interactions, page views within the plugin, mouse/tap position data (heatmaps), custom usage events, feature interactions, anonymized user identifiers | European Union |
| Google Analytics | Google LLC | Website analytics for mokko.ai only (not used within the Figma plugin) | Website browsing data, page views, referral sources, device information, cookies | United States |
| Sub-processor | Entity | Purpose | Data Processed | Location |
|---|---|---|---|---|
| Stripe | Stripe, Inc. | Payment processing and subscription billing, accessed through the mokko.ai website | Name, email address, payment card details, billing address, transaction history | United States |
| Sub-processor | Entity | Purpose | Data Processed | Location |
|---|---|---|---|---|
| Resend | Plus Five Five, Inc. | Transactional email delivery (account verification, password resets, subscription confirmations, and other service-related notifications) | Email address, name, email message content and metadata | United States |
Anthropic processes data under its commercial API terms. Anthropic does not use customer data submitted through the API to train or improve its models. API logs are retained for up to 30 days for safety and abuse monitoring purposes, after which they are deleted.
Mokko operates as a plugin within the Figma platform. Figma itself is not listed as a Mokko sub-processor because it is the host platform through which you independently grant the plugin access to your design data. Figma's own data practices are governed by Figma's Privacy Policy.
Our infrastructure is hosted in the European Union (Frankfurt, Germany). Some sub-processors are located in the United States. Where personal data is transferred outside the European Economic Area (EEA), we rely on the following legal safeguards:
| Sub-processor | Data Location | Transfer Mechanism |
|---|---|---|
| Anthropic | United States | Standard Contractual Clauses (SCCs), Module 2 (controller-to-processor), incorporated into Anthropic's DPA; governed by Irish law |
| OpenRouter | United States | Standard Contractual Clauses (SCCs) per Art. 46 GDPR, as stated in OpenRouter's Privacy Policy |
| Black Forest Labs | Germany (EU) | No cross-border transfer required (EU-based processor) |
| DigitalOcean | Germany (EU) | No cross-border transfer required (Frankfurt data center); DPF-certified with SCCs as fallback via DPA if data center changes |
| LangSmith | European Union | No cross-border transfer required (EU data residency) |
| Mixpanel | European Union | No cross-border transfer required (EU data center); DPF-certified with SCCs as fallback via DPA |
| Google Analytics | United States | EU-US Data Privacy Framework (DPF) certified (DPF listing) |
| Stripe | United States | EU-US Data Privacy Framework (DPF) certified (DPF listing); SCCs available as fallback via DPA |
| Resend | United States | EU-US Data Privacy Framework (DPF) certified; SCCs available as fallback via DPA |
Where sub-processors are DPF-certified, we rely on the EU-US Data Privacy Framework as the primary transfer mechanism. Where SCCs are in place, they serve as an additional or alternative safeguard. For sub-processors processing data within the EU, no cross-border transfer mechanism is required.
| Date | Sub-processor | Change |
|---|---|---|
| March 18, 2026 | Resend | Added Resend (Plus Five Five, Inc.) as transactional email sub-processor |
| March 17, 2026 | All | Initial publication of sub-processor list |
If you have questions about our sub-processors or wish to object to a new sub-processor during a notice period, please contact us:
Quadrate28 DMCC (Mokko)
AI Centre, Uptown Tower, Jumeirah Lake Towers
Dubai, United Arab Emirates
Phone: (+971)42 837 090
Email: [email protected]
See also: Privacy Policy | Terms of Service | Cookie Policy