Sub-processors
Last updated: 10 August 2026
These are the third-party services that can receive personal data when you use Onetap Business OS. This list is generated from the product's own configuration, so it reflects what the software can actually call.
Supabase — The production PostgreSQL database
The production PostgreSQL database. Every business record the product stores lives here. Data that can reach it: Account details (name, email, phone); Business records entered by the customer (parties, leads, invoices, documents); Employee records where the customer uses HR; Audit and consent logs. Processing region: not stated here — we do not publish a region we have not verified. Region is set on the Supabase project and must be confirmed there before any data-residency commitment is made to a customer.
Vercel — Runs the application and serves it
Runs the application and serves it. Request metadata (IP address, user agent) passes through it. Data that can reach it: IP address; User agent; Request paths; Anything submitted in a request. Processing region: not stated here — we do not publish a region we have not verified. Serverless functions execute in the configured region; confirm in the Vercel project before promising residency.
Razorpay — Takes subscription, trial and licence payments, and sends back verified payment webhooks
Takes subscription, trial and licence payments, and sends back verified payment webhooks. Data that can reach it: Name; Email; Phone; Amount and payment reference. Processing region: India. Card details are entered on Razorpay's own hosted page and never reach this application. No card number, CVV or expiry is transmitted to or stored by this product — only a payment id, status and amount.
Meta (WhatsApp Business Platform) — Sends and receives WhatsApp messages for tenants who connect their own WhatsApp number
Sends and receives WhatsApp messages for tenants who connect their own WhatsApp number. Data that can reach it: Recipient phone number; Message content; Delivery status. Processing region: not stated here — we do not publish a region we have not verified. Optional: this service is only used where it has been configured. Each tenant connects its OWN WhatsApp number and credentials; a tenant that has not connected one sends no WhatsApp at all.
Email delivery provider (SMTP) — Delivers transactional and campaign email
Delivers transactional and campaign email. Data that can reach it: Recipient name and email; Message content. Processing region: not stated here — we do not publish a region we have not verified. Optional: this service is only used where it has been configured. The specific provider is a deployment choice set in SMTP_HOST. Name the actual provider here before publishing to customers.
Google (Gemini API) — The primary AI provider
The primary AI provider. Powers document/catalogue extraction, the WhatsApp assistant, and 'generate with AI' features. Data that can reach it: The content of whatever the feature is acting on — which can include customer names, phone numbers, product and price data, and document text. Processing region: not stated here — we do not publish a region we have not verified. Optional: this service is only used where it has been configured. Whether prompts are retained or used for model training is governed by the Google API terms that apply to this account. It is NOT established by this codebase and must not be asserted to customers without checking the contract (§45).
OpenAI — Emergency fallback AI provider, used only when the primary provider fails
Emergency fallback AI provider, used only when the primary provider fails. Data that can reach it: The same content as the primary AI provider, for the requests that fall back. Processing region: not stated here — we do not publish a region we have not verified. Optional: this service is only used where it has been configured. Same retention/training caveat as the primary AI provider.
Anthropic — Optional tertiary AI fallback
Optional tertiary AI fallback. Inactive unless a key is configured. Data that can reach it: The same content as the primary AI provider, for the requests that fall back. Processing region: not stated here — we do not publish a region we have not verified. Optional: this service is only used where it has been configured. Same retention/training caveat as the primary AI provider.
Object storage (S3-compatible) — Stores uploaded files — documents, images and attachments
Stores uploaded files — documents, images and attachments. Data that can reach it: Uploaded file contents and file names. Processing region: not stated here — we do not publish a region we have not verified. Optional: this service is only used where it has been configured. The specific provider is a deployment choice set in STORAGE_ENDPOINT. Name the actual provider before publishing.
Google Analytics 4 — Measures use of the public marketing site
Measures use of the public marketing site. Data that can reach it: IP address (truncated); Pages viewed; Device and browser. Processing region: not stated here — we do not publish a region we have not verified. Optional: this service is only used where it has been configured. Loads only after a visitor accepts analytics cookies.
PostHog — Product analytics on the public site
Product analytics on the public site. Data that can reach it: Pages viewed; Device and browser; Interaction events. Processing region: not stated here — we do not publish a region we have not verified. Optional: this service is only used where it has been configured. Loads only after a visitor accepts analytics cookies.
Meta Pixel — Measures advertising campaigns on the public marketing site
Measures advertising campaigns on the public marketing site. Data that can reach it: Pages viewed; Device and browser; Conversion events. Processing region: not stated here — we do not publish a region we have not verified. Optional: this service is only used where it has been configured. Advertising, not measurement-only. Loads solely after a visitor accepts marketing cookies AND the operator has enabled it in Settings.
Sentry — Receives application error reports so faults can be diagnosed
Receives application error reports so faults can be diagnosed. Data that can reach it: Error messages and stack traces; The URL where the error happened; IP address. Processing region: not stated here — we do not publish a region we have not verified. Optional: this service is only used where it has been configured. An error report can incidentally contain personal data present in the failing request. Scrubbing configuration should be reviewed before relying on it not to.
Daily — Carries the live video, audio and screen sharing in a Client Connect session between a business and the customer it invited
Carries the live video, audio and screen sharing in a Client Connect session between a business and the customer it invited. Data that can reach it: Call audio and video; Shared screen content; Display name of each participant; IP address; Call start and end times. Processing region: not stated here — we do not publish a region we have not verified. Optional: this service is only used where it has been configured. A call is only created when a business starts one, and the customer joins through a single-use invite link. What is on a shared screen is whatever the participant chooses to show, so it can include anything visible on their device. Retention of any recording or metadata is governed by the Daily account configuration, which is not visible from this codebase — confirm it there before making a retention or residency statement.
Changes to this list
We update this page when we add or remove a service. Because it is generated from the product's configuration rather than maintained by hand, a new service cannot be added without appearing here.