The short version
- These are the companies that process personal data on our behalf to run HeloFlow.
- Your workspace's database and files are stored in India, in AWS's Mumbai region, through Supabase.
- AI providers only receive data when your workspace switches AI features on.
- We email workspace owners at least 15 days before adding or replacing a sub-processor.
This summary is here to help. The full text below is what applies.
How we choose them
Each provider below processes personal data only to deliver its service to us, under a contract that requires it to protect the data. We use as few providers as we can, and we store your workspace's database and files in India.
Current sub-processors
| Provider | What they do for HeloFlow | Personal data involved | Where |
|---|---|---|---|
| Meta Platforms, Inc. and its affiliates | WhatsApp Business Platform: sends and receives WhatsApp messages, reviews message templates | WhatsApp numbers, profile names, message content and media, WhatsApp Business Account details | Meta's global data centres |
| Supabase, Inc., on Amazon Web Services | Database, sign-in, file storage, server functions and sign-in emails | All workspace and account data | India (AWS Mumbai, ap-south-1) |
| Vercel Inc. | Hosting of the HeloFlow app and heloflow.com, and content delivery | Web requests, IP addresses, browser details | Global edge network; United States |
| Razorpay Software Private Limited | Payments for HeloFlow plans | Billing name, email, phone number, payment status | India |
| Google LLC | "Sign in with Google", only if you use it | Name, email address, profile picture | United States and global |
| OpenAI, L.L.C. | AI replies and knowledge-base search, only when AI features are on | Text of relevant messages, knowledge-base content | United States |
| Anthropic, PBC | AI replies, only if a workspace chooses Anthropic's models | Text of relevant messages, knowledge-base content | United States |
Services you connect yourself
Some services only receive data because you choose to connect them: your own webhooks and API keys, Zapier, Make, Pabbly, your own Razorpay account for payment links, and any AI provider key you add to your workspace. They are not our sub-processors. You decide what they receive, and your own agreement with each provider applies.
Changes
We will email Workspace owners at least 15 days before we add or replace a sub-processor, and update this page. If you have a data protection objection, see the Data Processing Agreement. Questions: privacy@heloflow.com.
Questions about this document?
Write to legal@heloflow.com or see all the ways to reach us.