Sub-processors
Version 2026-08-10Updated 10 August 2026
- Product
- Calanai Connect
- Published by
- CALANAI HQ LLP
Sub-processors
This page lists the third parties we engage to process personal data on behalf of our business customers, as referenced in our Privacy Policy and Data Processing Addendum.
About this list
To deliver Calanai Connect we rely on a small number of third-party providers. Each of them is bound by a written agreement imposing data protection obligations no less protective than those we owe to our customers, and we remain fully responsible to our customers for their performance.
We carry out due diligence before engaging any sub-processor and review the list periodically.
Change notifications
We give at least 15 days' notice before a new sub-processor begins processing customer personal data. Customers may object on reasonable, documented data protection grounds during that period, as set out in Section 5.5 of the DPA.
To subscribe to change notifications: email privacy@calanaihq.com with the subject line "Subscribe: sub-processor updates". We will add you to the notification list and confirm.
Current sub-processors
| Provider | Function | Categories of data processed | Location of processing |
|---|---|---|---|
| Meta Platforms, Inc. (Meta Platforms Ireland Limited for customers in the EEA) | WhatsApp Business Platform — message transmission and receipt, message template review, media handling, platform account management | Communications content and metadata; telephone numbers; template content | United States and global Meta infrastructure |
| Supabase, Inc. | Managed PostgreSQL hosting — the primary application data store | All categories of customer personal data stored in the Service | India (Mumbai, ap-south-1), on underlying Amazon Web Services infrastructure |
| DigitalOcean, LLC | Compute and application hosting; hosts the messaging, API, and background-processing services and the in-memory cache and job queue | All categories, in transit and in temporary storage | India (Bangalore, BLR1) |
| Google LLC | Artificial intelligence and machine learning inference (Gemini API) — intent classification, information extraction, and summarisation | Message content and recent conversation context submitted for automated processing | United States and global Google infrastructure |
| Clerk, Inc. | Authentication and identity management for dashboard users, and delivery of account invitation and authentication emails | Authorised User identity, contact, and session data. No End Customer data. | United States |
| Vercel, Inc. | Hosting and delivery of the dashboard application | Technical and session data in transit. No database access. | Global edge network |
| Cloudflare, Inc. | DNS, content delivery, web application firewall, denial-of-service protection, and encrypted origin connectivity | Network metadata and request data in transit | Global edge network |
| Functional Software, Inc. (trading as Sentry) | Application error and performance monitoring | Technical diagnostic data, and any incidental personal data contained in error context | United States |
Notes on this list
- Underlying infrastructure. Supabase operates on Amazon Web Services. We contract with Supabase, which is responsible for its own infrastructure providers under its agreement with us.
- Cache and job queue. These run on the DigitalOcean compute above and are not a separate provider.
- Email. Account invitation and authentication emails are sent by Clerk. We do not currently engage a separate transactional email provider.
- Payments. We do not currently engage a payment processor that handles customer personal data. This list will be updated, with the notice period above, before that changes.
- Support tooling. We do not currently engage a third-party support ticketing provider. This list will be updated, with the notice period above, before that changes.
Not sub-processors
The following are not sub-processors of ours, and are listed only to avoid confusion:
- Systems connected by a customer. Where a customer connects their own business system — such as a CRM or ERP — that system is controlled by the customer, not by us. Data exchanged with it flows at the customer's direction and under the customer's own arrangements with that provider.
- A customer's own service providers, including any agency or partner a customer authorises to access their account.
Affiliates
We currently have no affiliates that process customer personal data.
Questions
Contact privacy@calanaihq.com.