Subprocessors

OpenAI — generating agent replies

• What we send: the text of the messages in a conversation, and the instructions you configured for your agent.
• What we never send: the phone number or any other identifier of the person writing to you.
• Where: OpenAI OpCo, LLC, in the United States. Transfers are covered by the Standard Contractual Clauses as amended by the UK Addendum, under a signed Data Processing Addendum.
• Terms: a Data Processing Addendum under which OpenAI processes only on our instructions and does not train its models on the data.
• Retention: none. Requests are sent with storage disabled, so no copy is kept after the reply is returned.
• Only active while you have authorised AI processing and your agent is enabled.

Supabase — database and authentication

• What we send: everything the product stores — your account, your connected WhatsApp Business Account, your message history and the audit log.
• Where: Supabase, Inc., on infrastructure in the AWS eu-west region.
• Terms: a Data Processing Addendum, with encryption at rest and row-level isolation between workspaces.

Vercel — application hosting

• What we send: HTTP requests to the application, which pass through in transit. Message content is not stored here.
• Where: Vercel, Inc.
• Terms: a Data Processing Addendum covering hosting and edge delivery.

Changes to this list

We will notify workspace owners by email before a new subprocessor starts handling their data, and we will ask you to review your authorisation again inside the product before any change takes effect for your account.

Questions about anything on this page go to platform@aipaths.academy.