MONOKO — SUB-PROCESSOR LIST

Last Updated: 2026-05-17 Effective Date: 1 June 2026

This Sub-Processor List names the third parties that AEDOWON SINGAPORE PTE. LTD. (UEN 202612161D, "Monoko") engages to process personal data on its behalf. It is published in compliance with our Privacy Notice §4.1, our Data Processing Addendum §6, and our Terms of Service §12.7.

Sub-Processor Change Policy

We provide at least 30 days' prior notice before engaging any new material Sub-Processor or replacing an existing material Sub-Processor with one in a different jurisdiction. Notice is given via:

• Update to this list (with "Last Updated" date)
• Email to the billing-contact on record
• In-app banner

You may object to such change on reasonable grounds within the 30-day notice period (per Terms §12.7); if we cannot accommodate the objection, either party may terminate the affected portion of the Service with refund of unused prepaid fees.

1. AI MODEL PROVIDERS

These Sub-Processors process Your Input to generate AI Output and may process small amounts of metadata for safety, abuse monitoring, and rate-limiting.

Note on AI training: Each of the above providers offers an "opt-out of training" tier for Monoko's API usage. Monoko subscribes to the opt-out tier so that Your Input and Output are not used to train upstream AI models unless You have separately consented in Account → Privacy → AI Training.

2. PAYMENT PROCESSORS

These Sub-Processors handle payment authorization, settlement, chargeback management, and payouts. See also our Payment Processor Partners disclosure.

3. HOSTING / INFRASTRUCTURE

4. EMAIL / COMMUNICATION

Note on marketing email. Monoko composes and schedules marketing emails in-house (first-party system on Supabase / Vercel) and uses Resend as the email delivery transport. No third-party marketing-automation platform (Customer.io / Mailchimp / Loops / etc.) is engaged at launch.

5. ANALYTICS

Note on product analytics. Monoko operates product analytics (event tracking, funnel, retention) in-house as a first-party system on Supabase (database) and Vercel (application hosting) listed in §3. No third-party product-analytics Sub-Processor (PostHog / Mixpanel / Amplitude / Google Analytics / etc.) is engaged at launch. First-party event data is stored under Aedowon Singapore's controllership and processed within the safeguards of the Privacy Notice and DPA.

6. ADVERTISING NETWORKS (PER-USER OPT-IN ONLY)

These Sub-Processors receive Your behavioral / inferred-preference data only where You have affirmatively opted in per network via Terms §13B and our Cookie Notice §2.3.

7. IDENTITY VERIFICATION / KYC

At launch, no third-party KYC vendor is engaged. KOS NID / passport verification is performed by manual review by Aedowon Singapore personnel acting as authorized agents of Aedowon Singapore (per Privacy Notice §1 and DPA §6). Submitted NID / passport images are stored in our Supabase-managed file storage (§3) and accessed only by authorized personnel for the limited purposes of identity verification, anti-fraud, and tax-residency confirmation as disclosed in KOS Terms §11.1(j).

Where Monoko later engages a third-party KYC vendor (e.g., Sumsub, Onfido, Persona, Veriff), this section will be updated and the 30-day Sub-Processor change notice in §1 above will apply.

8. SANCTIONS / RESTRICTED-PARTIES SCREENING

At launch, no dedicated sanctions-screening vendor is engaged. Sanctions screening (OFAC SDN, UN Consolidated List, EU Sanctions Map, UK OFSI, Thailand AMLO, MAS Singapore) is performed via the built-in sanctions / fraud screening of our Merchant of Record / payout providers (currently Polar.sh and Wise or banking partners where used), each of which performs screening on relevant payment counterparties as a regulatory obligation of its own licenses.

Aedowon Singapore additionally retains discretion to perform manual screening at KOS / Affiliate approval per the eligibility criteria in Main T&C §8.2.

Where Monoko later engages a dedicated sanctions-screening vendor (e.g., ComplyAdvantage, Refinitiv World-Check, sanctions.io), this section will be updated and the 30-day Sub-Processor change notice in §1 above will apply.

9. CUSTOMER SUPPORT / HELPDESK

Customer support is delivered through Dabby, an AI chatbot product operated by AEDOWON SINGAPORE PTE. LTD. itself (the same legal entity that operates Monoko). Because Dabby is operated by the same controller, it is not a third-party Sub-Processor; it is an internal operational tool. Support conversations, ticket metadata, and chat content processed by Dabby remain under Aedowon Singapore's controllership and within the protections of our Privacy Notice and Data Processing Addendum.

Where support escalation requires email correspondence (e.g., billing disputes, legal notices, DPO requests, KOS / Affiliate disputes), the email Sub-Processors listed in §4 above are used.

10. ADVERTISING-PLATFORM INTEGRATIONS (USER-INITIATED OUTBOUND)

When You instruct Monoko to publish or push Output to an external advertising platform, that platform processes Your Input/Output and audience data as a separate controller per Your instruction. These are not Sub-Processors of Monoko but recipients to whom You direct disclosure:

• Meta Business (Facebook / Instagram Ads Manager)
• Google Ads / Google Business Manager
• TikTok Ads Manager
• LINE Official Account Manager / LINE Ads Platform
• YouTube Studio

For data Monoko sends on Your behalf at Your instruction, the receiving platform's privacy policy governs subsequent processing.

11. RECORD OF CHANGES

CONTACT

DPO: dpo@monoko.ai Sub-Processor Objections: dpo@monoko.ai (recommended subject line: "Sub-Processor Objection" plus the relevant provider name)

END OF MONOKO SUB-PROCESSOR LIST — V1 Last Updated: 2026-05-17