Sub-processors
Last updated: 2 September 2026
To run Connect Wasl we use a small set of trusted service providers ("sub-processors") that process personal data on our behalf. Our primary database and file storage are in the European Union (Supabase, Frankfurt). Some sub-processors are incorporated in the United States, so certain data (for example, message content sent for AI replies or queued for delivery) is processed there. We list all of them below.
Current sub-processors
| Sub-processor | Purpose | Personal data | Region |
|---|---|---|---|
| Meta Platforms (WhatsApp Business Cloud API) | Send and receive WhatsApp messages | End-customer name, phone number, message content and media | Meta infrastructure (global); EU Local Storage option under review |
| Supabase | Managed database, file storage, authentication | All account and end-customer data at rest | AWS eu-central-1 (Frankfurt, EU); US-incorporated parent company |
| Anthropic (Claude API) | AI replies, only when a business enables the AI assistant | Inbound and outbound message content and the business profile | United States; not used to train models per the API terms |
| Upstash (QStash) | Queue for broadcast and automation scheduling | Job payloads may include recipient phone number and template values | United States; transient |
| Stripe | Subscription billing | Connect Wasl account-owner billing details (our own controller data, not end-customer data) | United States / global |
| Resend | Transactional and authentication email | Recipient email address and message content | United States |
| Sentry | Error monitoring | May incidentally capture personal data in error context (scrubbing configured) | United States |
| Cloudflare | CDN, WAF, and bot protection (Turnstile) | Traffic metadata and IP addresses | Global edge network |
| Vercel (marketing site) and Render (application) | Compute and hosting | Transits application traffic | Region under confirmation |
International transfers
Our database is in the EU, but because some sub-processors are in the United States and our customers and their contacts are in Saudi Arabia and the wider Gulf, personal data may be transferred across borders. Where it is, we rely on appropriate safeguards, including Saudi Standard Contractual Clauses and data minimization, so only what is needed reaches each provider.
Changes to this list
We keep this page current. When we add or replace a sub-processor in a way that materially affects the processing of customer data, we notify affected controllers as set out in our Data Processing Agreement. For questions, contact info@connectwasl.com.