ChirplyLegal
Sub-processors
The complete list of vendors that may handle personal data on our behalf, what each one does, and where it processes. Published 2026-09-05.
Each vendor below is bound by contract to protect the data it handles, on terms no less protective than our own Data Processing Agreement. We remain responsible to you for what they do.
| Vendor | What it does | Data it can see | Location | Added |
|---|---|---|---|---|
| Supabase | Primary database, authentication, and file storage | All customer content, account credentials, uploaded files | United States | 2026-09-05 |
| Cloudflare | Application hosting, DNS, CDN, and object storage (R2) | Request metadata, IP addresses, cached assets, recordings and media | United States, with a global edge network | 2026-09-05 |
| Stripe | Payment processing and subscription billing | Billing name, email, address, and payment method (card data goes to Stripe directly and never reaches us) | United States, Ireland | 2026-09-05 |
| Twilioyour account | Telephony, SMS, and call recording transport | Phone numbers, call metadata, message bodies, recordings | United States, with regional edge options | 2026-09-05 |
| Mailgun (Sinch)your account | Outbound and inbound email delivery | Email addresses, message subjects and bodies, delivery events | United States, with an EU region available | 2026-09-05 |
| Meta Platforms | Facebook and Instagram messaging, lead forms, and ad reporting | Social profile identifiers, message content, lead form submissions | United States, Ireland | 2026-09-05 |
| OpenRouter | Routing prompts to AI models for assistive and generative features | Only the content a user submits to an AI feature at the moment they use it | United States | 2026-09-05 |
| Resend | Transactional email for platform notices and authentication | Email address, name, and the contents of the notice being sent | United States | 2026-09-05 |
Changes to this list
We give at least 30 days’ notice before adding or replacing a sub-processor, so you have a real opportunity to object. If you object on reasonable data protection grounds we will work with you on an alternative, and if none exists you may terminate the affected part of the service and receive a pro-rata refund.
See also our Data Processing Agreement, Security, and Privacy Policy.