Sub-processors
Last updated: 17 October 2026
To run Connect Wasl we use a small set of trusted service providers ("sub-processors") that process personal data on our behalf. Our primary database and file storage are in the European Union (Supabase, Frankfurt). Some sub-processors are incorporated in the United States, so certain data (for example, message content sent for AI replies or queued for delivery) is processed there. We list all of them below. The advertising platforms that receive measurement reports about our own accounts are listed separately: they are not sub-processors.
Current sub-processors
| Sub-processor | Purpose | Personal data | Region |
|---|---|---|---|
| Meta Platforms (WhatsApp Business Cloud API) | Send and receive WhatsApp messages | End-customer name, phone number, message content and media | Meta infrastructure (global); EU Local Storage option under review |
| Meta Platforms (Instagram and Messenger APIs) | Send and receive Instagram and Messenger messages, and answer comments on the business's posts | End-customer name or username, Meta-scoped ID, message and comment content and media | Meta infrastructure (global) |
| Supabase | Managed database, file storage, authentication | All account and end-customer data at rest | AWS eu-central-1 (Frankfurt, EU); US-incorporated parent company |
| Anthropic (Claude API) | AI replies, only when a business enables the AI assistant | Inbound and outbound message content and the business profile | United States; not used to train models per the API terms |
| Upstash (QStash) | Queue for broadcast and automation scheduling | Job payloads may include recipient phone number and template values | United States; transient |
| Stripe | Subscription billing | Connect Wasl account-owner billing details (our own controller data, not end-customer data) | United States / global |
| Resend | Transactional and authentication email | Recipient email address and message content | United States |
| Sentry | Error monitoring | May incidentally capture personal data in error context (scrubbing configured) | United States |
| Cloudflare | CDN, WAF, and bot protection (Turnstile) | Traffic metadata and IP addresses | Global edge network |
| Vercel (marketing site) | Marketing website hosting and CDN | Public website request metadata (IP, user agent); no end-customer message data | Washington, D.C., USA (us-east-1) |
| Render (application) | Application hosting and compute | Transits application traffic | Frankfurt, Germany (EU) |
Advertising platforms (not sub-processors)
These platforms receive advertising-measurement reports about our own accounts, as independent controllers under their own terms. They never receive a customer's contacts or conversations, and a platform receives nothing about an account that did not arrive from its ad. What each one gets is set out in the Privacy Policy, section 3, "How we share personal data".
| Platform | Purpose | Personal data | Region |
|---|---|---|---|
| Google (Analytics, Tag Manager, Ads) | Website and app usage measurement; ad conversions imported from Google Analytics | Website visitor usage data; in the app, event names and campaign labels; website and sign-up measurement, including payments and bookings reported from our servers. Never name, email or phone | United States / global |
| Meta Platforms (advertising measurement) | Meta pixel on the marketing website; Conversions API reports of sign-up, WhatsApp connection and payment from our servers | Ad-click identifier (fbclid), event time, browser user agent, payment amount and currency. No name, email or phone | United States / global |
| TikTok (advertising measurement) | TikTok pixel on the marketing website; Events API reports of sign-up, WhatsApp connection and payment from our servers | Ad-click identifier (ttclid), event time, browser user agent, payment amount and currency. No name, email or phone | United States / Singapore |
| Snapchat (advertising measurement) | Snap pixel on the marketing website; Conversions API reports of sign-up and WhatsApp connection from our servers (no payments) | Ad-click identifier (ScCid), event time, browser user agent and IP address. No name, email or phone | United States |
International transfers
Our database is in the EU, but because some sub-processors are in the United States and our customers and their contacts are in Saudi Arabia and the wider Gulf, personal data may be transferred across borders. Where it is, we rely on appropriate safeguards, including Saudi Standard Contractual Clauses and data minimization, so only what is needed reaches each provider.
Changes to this list
We keep this page current. When we add or replace a sub-processor in a way that materially affects the processing of customer data, we notify affected controllers as set out in our Data Processing Agreement. For questions, contact info@connectwasl.com.