Legal
Subprocessors
Third parties that process data on our behalf, what they do, and what they see.
Draft — review required before launch
This text is written against what the system actually does, and every company-specific detail is left as a {{PLACEHOLDER}} to be filled in. It has not been reviewed by a lawyer, and DPDP and GDPR exposure here is real. Do not publish it as-is.
Last updated 16 August 2026
On this page
At a glance
- Six subprocessors, each a dependency the architecture actually names — not a generic vendor list.
- Only AWS (Mumbai) holds customer data at rest; the others see slices needed for their specific job.
- Our auth provider never sees your contacts — staff users and contacts are structurally separate.
- We give notice before adding a subprocessor that processes customer data, so you can object.
Current subprocessors
| Subprocessor | Purpose | Location | Data |
|---|---|---|---|
| Amazon Web Services | Hosting, database, storage, email delivery (SES) | India (ap-south-1) | All customer data |
| Clerk | Authentication for staff users | United States | Staff names, emails, sessions. Never contacts |
| Google (Gemini) | Voice-note transcription, translation, agent reasoning | United States | Message content passed for processing |
| Meta Platforms | WhatsApp Business messaging | United States / Ireland | Message content and recipient identifiers |
| Vercel | Hosting for the dashboard and this website | Global edge | Request metadata. No customer records |
| Cloudflare | DNS and traffic protection | Global edge | Request metadata |
Worth noting
Clerk never sees your contacts. It authenticates the people who work for you and nothing else. The separation is structural — staff users and contacts are different tables, for permission reasons that predate the choice of auth provider.
Ad networks are read-only. We import performance data and send conversion outcomes back. We do not create campaigns, change budgets or spend money on your behalf.
Changes
We will give notice before adding a subprocessor that processes customer data, so you have the opportunity to object.