Legal.
Sub-processors
Version 2 · Last updated
These services process data on our behalf. Our Data Processing Addendum covers them: we tell workspace Owners in the app 30 days before we add one.
| Sub-processor | Purpose | Data it sees | Location |
|---|---|---|---|
| Netcup | Server for the web app, the database, sign-in and file storage (the open-source Supabase software, run by us), the background worker and the Valkey cache | All app data; all data in processing; the cache | To be confirmed |
| Zoho | Delivers the sign-in codes our sign-in service sends by email | The email address a code is sent to, and the code | India |
| Amazon Web Services | Lambda courier fetchers, S3 archives and backups | Tracking numbers; logs; backup copies of the database and files | ap-south-1 (Mumbai) |
| Cloudflare | DNS, CDN, firewall and Turnstile | Traffic in transit | Global edge |
| Razorpay | Online payments, used only if online payment is switched on (it is off now) | Billing contact and payment data, only while online payment is on | India |
| “Continue with Google” sign-in | The user's name and email address | Global | |
| DataImpulse | Residential proxy used to reach a courier offered through the API | Tracking numbers in transit | To be confirmed |
| ParcelsApp | Fallback lookup when an API courier refuses | Tracking numbers | To be confirmed |
| shreeanjanicouriertracking.com | Unofficial fallback for Shree Anjani, only while it is switched on | Tracking numbers | To be confirmed |
Not sub-processors
GitHub holds our code and runs its checks; it sees no customer data. Google Analytics and AdSense run only on the public website, never in the app.
Transfers outside India
Where a sub-processor works outside India, the table says so. The Act lets the government restrict transfers to countries it notifies; we follow any such restriction.