Subprocessors
Last updated Jul 2, 2026
This page lists the third-party providers (“subprocessors”) ParFlow uses to process personal data on behalf of business customers, as part of our Data Processing Addendum (/dpa). We update this page before adding or replacing a subprocessor that processes customer personal data.
Current subprocessors
| Provider | Purpose | Data categories | Required / optional | Location |
|---|---|---|---|---|
| Supabase | Database, authentication, and file storage (including voice recordings, where enabled) | All service data: CRM records, conversations, account data | Required (core infrastructure) | Cloud regions used by ParFlow's hosting and database infrastructure; DPA with standard contractual clauses |
| Vercel | Application hosting, compute, and scheduled jobs | Data in transit through the application; request logs | Required (core infrastructure) | United States / global edge; DPA with standard contractual clauses |
| OpenAI | AI processing: agent replies, summaries, semantic search, and voice conversations (where enabled) | Conversation content, configured business knowledge, voice audio (where enabled) | Required for AI features; API data not used to train its generally available models by default | United States; DPA with standard contractual clauses |
| Resend | Transactional email delivery (verifications, notifications, summaries, invites) | Recipient email addresses and message content | Required for email features | United States; DPA with standard contractual clauses |
| Polar | Billing, checkout, and subscription management (as merchant of record) | Customer billing details and payment data — card details never reach ParFlow | Optional — active on paid plans | United States / EU; own compliance as merchant of record |
| Twilio | WhatsApp / SMS messaging | Phone numbers, message content, delivery status | Optional — only when a messaging channel is enabled | United States / global; DPA with standard contractual clauses |
| Calendar integration (availability checks and booking events) | Calendar events and availability of the connected account | Optional — only when a customer connects Google Calendar | United States / global; Google API Services User Data Policy applies |
Changes to this list
Before adding or replacing a subprocessor that processes customer personal data, we update this page and refresh the “last updated” date above. Customers with a reasonable data-protection objection to a change can contact us within 14 days, as described in the Data Processing Addendum (/dpa).
Questions about our subprocessors? Email us at Lior@parflow.cc.