Subprocessors
Last updated: October 24, 2026
This page lists key subprocessors that help OwnersPal deliver and operate the Service. These vendors may process personal or business data only as needed to provide infrastructure, billing, communications, security, and platform integrations.
| Vendor | Purpose | Data categories | Region |
|---|---|---|---|
| Supabase | Authentication and application data storage | Account profile data, auth identifiers, business profile data, generated content metadata | Global |
| Stripe | Subscription billing, payment processing, and sales-tax calculation | Billing identifiers, billing address, subscription status, payment metadata, invoicing records, and the number of overage minutes billed for metered add-ons such as the phone assistant (no call content) | Global |
| Resend | Transactional email delivery | Email address, message metadata, delivery and bounce events | US |
| Railway | Backend API hosting and runtime infrastructure | Application logs, request metadata, operational diagnostics | US |
| Vercel | Frontend hosting, delivery, domain availability lookups, and consented analytics | Site request metadata, performance telemetry, consented analytics events, domain names an owner checks for availability | Global |
| Sentry | Error monitoring and performance diagnostics | Error traces, technical diagnostics, limited request context | Global |
| Fal / model providers | Model-inference gateway (queue.fal.run) for short ad-video rendering (including image steps such as product shots) and Brand Photoshoot styled photo versions. For Brand Photoshoot it routes image-editing requests to third-party image models — OpenAI's GPT Image (primary) and Google's Nano Banana 2 (fallback; Google's model embeds an invisible SynthID watermark) — which add generic set dressing and lighting around an owner's real photo. For a product photo it also routes a background-removal cut-out to BiRefNet, then paints the studio set around the owner's own real product pixels with OpenAI's GPT Image or, as a fallback, Black Forest Labs' FLUX Fill. Routes each image-to-video job to the model selected for the shot: Kling (Kuaishou), Seedance (ByteDance), Veo (Google), Grok (xAI), Vidu, Wan, or MiniMax H3 (an open-weight MiniMax model). | Business photo URLs and text prompts submitted for rendering or photo work — for Brand Photoshoot styled versions, the owner's cropped photo plus a text prompt describing the scene, light and set dressing and quoting any printed words so they stay unchanged, which fal.ai passes to OpenAI, Google or Black Forest Labs; for a product photo, the owner's full source photo is also sent for a background-removal cut-out — photos of your team you choose for product-holding shots, generation-job metadata, and output video and image references | Global |
| ElevenLabs (via Fal) | Voice-hook text-to-speech for video ads (opt-in feature; preset voices only, no voice cloning) | Short text strings derived from your business profile (business name, hours, CTA) sent for synthesis; no customer or review content | US |
| ElevenLabs (phone assistant) | Answers calls to the phone numbers we provide for the optional phone assistant: it listens to the caller in real time, turns speech into text and speaks the replies in a preset synthetic voice (no voice cloning). Each reply is written by Google's Gemini language model, reached through ElevenLabs. Calls made while a business's phone assistant is off or cannot answer are handled by Twilio alone and never reach ElevenLabs, except a call that came in while the assistant was already on as many calls as the business allows at once and that no one at the business's transfer number accepted, which the assistant then answers only to take a message. If ElevenLabs picks up a call but our service cannot confirm it, ElevenLabs plays a fixed message saying the line is unavailable and ends the call. Calls are not recorded. The phone assistant only answers calls: it makes no outbound calls of its own (it only connects a caller to the business's transfer number) and sends no text messages. | Caller audio, processed live and not recorded; the caller's phone number (unless withheld); the words of the call as text, which the language model reads to write each reply; the call transcript and summary, which ElevenLabs holds in unredacted form until it deletes them at our request, made once the call ends (normally right after the call, and within two days if we do not receive the call's end notice), and in any case for no more than 30 days (if that notice never reaches us and we also could not link the call to its conversation when it started, we cannot tell ElevenLabs which conversation to delete, and only that 30-day limit applies); and, sent at the start of each call, the business's published information (name, hours, menu or services, FAQ, address, time zone), its greeting and the phone number it set for transferring calls | US |
| Google (Gemini) | Writes the replies of the optional phone assistant: ElevenLabs sends it the words of the call so far, as text, together with the business's published information, and it returns the next reply. Calls made while a business's phone assistant is off or cannot answer are handled by Twilio alone and never reach it, except a call that came in while the assistant was already on as many calls as the business allows at once and that no one at the business's transfer number accepted, which the assistant then answers only to take a message. If ElevenLabs picks up a call but our service cannot confirm it, it may read anything the caller says, as text, before the call ends. It is reached only through ElevenLabs and never receives call audio. | The words of the call so far as text (the caller's questions and the assistant's earlier replies, before sensitive details are removed) and the business's published information (name, hours, menu or services, FAQ, address, time zone) | Global |
| OpenAI | Text + vision inference for AI features (captions, image intelligence, content safety analysis) + Brand Photoshoot (reading each photo, planning each shot as art director, stylist and photographer, and checking each styled version against the real photo) + website content extraction (menus, team, FAQ, About, customer testimonials) + monthly AI-visibility probing (Presence+) + on-site AI assistant answers | Prompts, uploaded images submitted for composition + safety analysis, photos and styled results submitted to Brand Photoshoot's vision model (to read each photo — subject, faces, printed words, light — and to check each styled version against the original), the text notes from those reads and business details (name, type, brand colors, words to avoid, menu item names) used to plan each shot, generated outputs, request and response metadata, website page text submitted for content extraction, business category/city/name submitted for AI-visibility probing and the returned answer's mention + competitor-name extraction, visitor questions sent to the on-site AI assistant | US |
| Anthropic | Text + vision inference (Claude models) for the same AI features as OpenAI above — captions, card hooks, photo reads and video planning, Brand Photoshoot planning and checks, website content extraction, translations and the website assistant — when we run those features on Anthropic instead of OpenAI. Added to this list on October 18, 2026. | The same prompts, photos and business details those features send to OpenAI (see the OpenAI row), for the features we run on Anthropic. | US |
| Headless render endpoint (optional) | Renders JavaScript-only (single-page-app) business websites so we can read their menu and photos when the page injects content client-side. Off by default; only used when an operator configures a render endpoint, and only against the business's own public site. | The business's own public website URL (no personal data) | Global |
| Twilio | SMS and WhatsApp messaging delivery, and the phone line that carries calls to the phone assistant; calls made while a business's phone assistant is off or cannot answer are handled by Twilio alone, which connects them to the business's transfer number or plays a fixed voice message (except a call that came in while the assistant was already on as many calls as the business allows at once and that no one at the transfer number accepted, which the assistant then answers only to take a message); when Twilio rings the transfer number for those calls or for a call the assistant transfers (other than a call made while our service cannot be reached), the person who answers first hears a fixed voice message and is connected to the caller only after pressing 1, and that leg of the call is not recorded and no AI hears it | Phone numbers, message content metadata, delivery and status events; for phone assistant calls, the caller's number, the phone assistant number and the number a call is transferred to, and the call's time, length and status (call audio passes through Twilio live and is not recorded), and the business's transfer number, which Twilio keeps in the phone assistant number's settings so that it can still connect calls when our service cannot be reached; we ask Twilio to remove it from there when the business changes or clears it or deletes its account, and keep retrying until it is removed (until then, a call made while our service cannot be reached may still be connected to the old number). We ask Twilio to delete its log of each phone assistant call once it ends: normally right after the call, and within two days if we do not receive the call's end notice. For a call made while our service was down, we ask within about an hour of our service coming back; the log of a call made more than three days before then stays with Twilio under its own retention; Twilio may keep records that the law requires it to keep | Global |
| MessageBird | Failover SMS delivery for operational alerts (opt-in) | Recipient phone number, message content | EU |
| Google APIs (Business Profile, Ads, YouTube, Search Console, Site Verification) | OAuth integrations and connected platform operations. For owners who connect their own Google Search Console in the guided setup: the Search Console API and the Site Verification API, used only to verify the owner's website with Google, add it to their Search Console, submit its list of pages and check that they are still listed as its owner | OAuth tokens, connected account identifiers, campaign and posting metadata, the post text, images and videos we publish on your behalf, and Google Business Profile reviews (cached for the optional review-overlay feature when enabled by the owner); for Search Console and Site Verification: the website's address, the verification code Google issues for it and the owner's permission level for the website in Search Console (no Search Console performance data, such as searches, clicks or impressions, is read) | Global |
| Google Ads tag and conversion upload | Ad-conversion measurement for a business that connects a Google Ads account: its own Google Ads tag on its OwnersPal website, loaded only at the website's main address after the visitor accepts marketing cookies there and sends no Global Privacy Control signal, plus a once-a-day upload of its attributed bookings as Google Ads click conversions | From the visitor's browser, after marketing-cookie consent: the events the business's own Google Ads tag sends — a page view carrying the IP address, browser and device information, the page address and referring page, and Google's ad-click cookie identifiers (such as _gcl_aw, _gcl_au and _gcl_gs, stored on the website's main address only, plus a _gcl_ls entry in the browser's local storage). The tag's requests to Google's servers (such as google.com, googleadservices.com and doubleclick.net) also carry, and may set, Google's own cookies on Google's domains (such as IDE and NID), which Google controls. If the business has turned on enhanced conversions in its own Google Ads account, the tag may also send a hash of contact details entered into the website's forms. From our servers, once a day, per attributed booking: a SHA-256 hash of the customer's email/phone, the campaign click id (gclid), the booking time and an internal booking reference — contact details never leave in the clear and the hash is never stored | Global |
| Google Places API | Business lookup — finds a business's public Google Maps listing (places.googleapis.com) and fills in its details on the owner's profile and website; details the owner doesn't confirm are removed within 30 days and are not sent on to the owner's other listings before then. For owners using guided setup, it also checks that the business's Google listing can be found and shows the owner's website; that check keeps only the listing's place ID and whether it shows the website, plus the place ID of a search result that turned out not to be the business's listing, so it is not looked up again for 29 days. Competitor places picked for ad targeting are kept only as their place ID: their names are looked up live when shown, and their map locations when a Meta (Facebook/Instagram) campaign launches. Photos from the listing are shown live, with their credit, only on the owner's website and in a one-photo preview the owner sees when linking their listing. We no longer save photos from Google Maps or use them in new videos, photoshoots, ads, cards or posts. The links to Google Maps photos we had saved were deleted, except in our record of posts already published. We still keep the copies inside videos and cards that were already made, and photoshoot versions already made from a Google Maps photo, which only that business can see and which can't be used for anything new. Uses an API key, separate from the owner's OAuth Google connection. | Business name, place ID and location queries sent to Google; in return, public listing details (name, address, phone, website, opening hours, rating, price level, amenities, whether it is open, Google's description of the business (its editorial summary), its business category and types, and its map location) that we keep for at most 30 days unless the owner confirms them as their own — including the copies filled in on the owner's profile and website (also the name, location and type of business picked from the listing during sign-up, and the map pin and address picked from a Google search on the ad-targeting map), translations of Google's description, and the copies made from them in the owner's ad-targeting plan and saved presets, listing checks, AI search visibility checks and records of which details generated content used; a map pin the owner moves is their own — and photo references with their author credits that are used only for a live display and are not saved (we no longer save photos from Google Maps, and the links to Google Maps photos we had saved earlier were deleted, except in our record of posts already published). We still keep the copies of Google Maps photos inside videos and cards that were already made, including working copies made while producing those videos (for example cropped frames, enhanced copies and copies sent to a video provider), and photoshoot versions already made from a Google Maps photo, which only that business can see and which can't be used for anything new. Competitor places picked from a Google search for ad targeting are kept only as their place ID; their names and addresses are shown live, and their map locations are looked up when a Meta (Facebook/Instagram) campaign launches. The guided setup's listing check sends the listing's place ID, or the business name and address or location, and reads back the listing's name and website; it keeps only the place ID and our own verdict on whether the listing shows the owner's website, and the place ID of a search result that turned out not to be the business's listing (so it is not looked up again for 29 days), not the name or website it read. Not deleted with the details: content the owner makes while a detail is in their profile (such as videos, cards, posts, reports and marketing text) and our records of how it was made; the web address of the owner's website, which is made from the business name; and copies the owner sends to other services — Meta (Facebook/Instagram) receives the targeted map locations of the owner's campaigns there with their labels (which can include a Google map pin or business name, and the map locations of competitor places), TikTok receives only those labels, to find the areas to target, and the AI providers listed on this page receive the details they work from. When an owner's website shows these photos, the visitor's browser loads them directly from Google, which receives the visitor's IP address and browser information. When an owner links their listing, the owner's browser loads a one-photo preview directly from Google, which receives the owner's IP address and browser information. | Global |
| Google Maps (embedded map) | When a business shows a location map on its OwnersPal website, the visitor's browser loads an embedded Google Maps frame (maps.google.com). OwnersPal makes no server-side call for it; the iframe is a third-party data flow on page view. | The visitor's IP address and user-agent (sent by the browser to load the embedded map); the business's public address or map query | Global |
| YouTube (embedded video) | When a business embeds its own YouTube video on its OwnersPal website, the visitor's browser loads the clip from YouTube. We use the privacy-friendly youtube-nocookie.com host, which doesn't set a tracking cookie until the visitor presses play. OwnersPal makes no server-side call to YouTube for this. | The visitor's IP address and request metadata (sent by the browser to load the embedded video); the public video ID | Global |
| Vimeo (embedded video) | When a business embeds its own Vimeo video on its OwnersPal website, the visitor's browser loads the clip from Vimeo's player (player.vimeo.com). OwnersPal makes no server-side call to Vimeo for this. | The visitor's IP address and request metadata (sent by the browser to load the embedded video); the public video ID | Global |
| Meta APIs (Facebook/Instagram) | OAuth integrations and connected platform operations | OAuth tokens, connected account/Page/Instagram-business identifiers, the video/image content and captions we publish on your behalf, Page and ad-campaign performance metrics, and — when a connected Page or Instagram account receives one — the text and author name of inbound comments and direct messages, which we mirror into your OwnersPal inbox | Global |
| Meta Pixel and Conversions API | Ad-conversion measurement for a business that connects a Meta ad account: its own Meta Pixel on its OwnersPal website, loaded only when the website's main address is the business's own domain name itself (not an ownerspal.app address or an address under another domain) and only after the visitor accepts marketing cookies there and sends no Global Privacy Control signal, plus a once-a-day upload of its attributed bookings to the Meta Conversions API | From the visitor's browser, after marketing-cookie consent at the business's own domain: the events the business's own Meta Pixel sends — a page view carrying the IP address, browser and device information, the page address and referring page, and Meta's first-party cookie identifiers (_fbp, _fbc, placed on that domain); the Pixel's automatic event detection is switched off. The Pixel's requests to Meta's servers (facebook.com, facebook.net) also carry, and may set, Meta's own cookies on Meta's domains, which Meta controls. If the business has turned on automatic advanced matching in its own Meta account, the Pixel may also send a hash of contact details entered into the website's forms. From our servers, once a day, per attributed booking: a SHA-256 hash of the customer's email/phone, the campaign click id (fbclid), the booking time and an internal booking reference — contact details never leave in the clear and the hash is never stored | Global |
| Microsoft Ads | OAuth integrations and connected platform operations | OAuth tokens, connected account identifiers, campaign and conversion metadata | Global |
| Yelp | OAuth integrations and connected platform operations | OAuth tokens, connected business identifiers, review and listing metadata | US |
| TikTok | OAuth integrations and connected platform operations | OAuth tokens, connected account identifiers, the videos and captions we publish on your behalf, and post and engagement metadata | Global |
| Nextdoor | OAuth integrations and connected platform operations | OAuth tokens, connected business identifiers, the post text, images and videos we publish on your behalf, and post and reply metadata | US |
| X (Twitter) | OAuth integrations and connected platform operations | OAuth tokens, connected account identifiers, the post text, images and videos we publish on your behalf, and post and engagement metadata | Global |
| OAuth integrations and connected platform operations | OAuth tokens, connected organization Page identifiers, the post text, images and videos we publish on your behalf, and post and engagement metadata | Global | |
| Square (Block, Inc.) | Photo import the business owner turns on: copies the photos from the owner's own Square item library into their media library, with read-only access to that library | OAuth tokens, the Square merchant ID, item names and item photos | US |
| IndexNow (via Seznam.cz) | When an owner publishes their website, and when they choose "Show my website on Google", tells search engines which pages changed so they are found sooner. Seznam.cz receives the notice and shares it with the other search engines that take part in IndexNow, such as Bing, Yandex and Naver. Only for owners who chose to show their website on search engines. | The web addresses of an owner's published pages, only when they chose to show their site on search engines (public page addresses only) | Global |
We update this list as vendors and subprocessors change.