Subprocessors
When you use Convoup, certain data is processed by third-party services (subprocessors) that help us deliver the platform. This page lists all subprocessors that may process your data, what they do, and where they operate.
Last updated: September 1, 2026
Messaging Platform
Meta Platforms, Inc.
Purpose
WhatsApp Business Platform (Cloud API) — message delivery, template management, webhook events, and Embedded Signup.
Data Processed
Phone numbers, message content, templates, delivery/read statuses, WABA metadata.
Processing Location
United States (default). EU data residency available via Cloud API Local Storage.
Certifications
ISO/IEC 27001, SOC 2 Type II, SOC 3.
Cloud Infrastructure
Vercel Inc.
Purpose
Website hosting, CDN, and edge functions for convoup.com.
Data Processed
Static assets, page content, analytics data.
Processing Location
United States and global edge network.
Certifications
SOC 2 Type II, ISO 27001.
Supabase Inc.
Purpose
Database hosting, authentication, and real-time subscriptions.
Data Processed
Account data, contacts, conversations, message history, configuration.
Processing Location
United States. EU region available.
Certifications
SOC 2 Type II.
AI Providers
Google LLC (Gemini)
Purpose
AI-Assisted Support — generates draft replies for human review. Customer content is sent only when a user requests an AI suggestion.
Data Processed
Message content (transient, not stored by Google after response).
Processing Location
United States.
Certifications
ISO/IEC 27001, SOC 2 Type II, SOC 3.
Anthropic, PBC (Claude)
Purpose
AI-Assisted Support — generates draft replies for human review. Customer content is sent only when a user requests an AI suggestion.
Data Processed
Message content (transient, not stored by Anthropic after response).
Processing Location
United States.
Certifications
SOC 2 Type II.
Analytics & Monitoring
PostHog Inc.
Purpose
Product analytics — usage patterns, feature adoption, performance monitoring.
Data Processed
Anonymized usage events, page views, feature interactions.
Processing Location
United States. EU cloud option available.
Certifications
SOC 2 Type II.
AI subprocessors process message content only when a user explicitly requests an AI-generated reply. Content is not used to train models and is not retained after the response is generated.
Meta processes message data as part of the WhatsApp Business Platform. Their data handling is governed by the WhatsApp Business Data Processing Terms.
This list is updated when subprocessors are added or replaced. Customers will be notified of material changes.