Sub-processors
These are the companies that help us run OkBell and may handle personal data for us. Each one acts only on our instructions, under a contract that protects the data.
We give 30 days' notice before we add or replace one.
The list
| Sub-processor | What it does for OkBell | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, our servers, databases, file storage, email sending. Its AI service helps draft translations of message templates; no personal data is sent to it | Global network. Storage in the Asia-Pacific region. For businesses in the EU, EEA and UK (when we serve them): their payers' data is stored in the EU |
| PlanetScale, Inc. (through Cloudflare) | The database that holds business records | AWS ap-south-1 (Mumbai). For businesses in the EU, EEA and UK (when we serve them): AWS eu-central-1 (Frankfurt) |
| Meta Platforms (WhatsApp Business) | WhatsApp messages from OkBell's number | Global |
| Walkover Web Solutions (MSG91) | SMS in India, and sign-in codes | India |
| Google (Firebase Cloud Messaging) | Notifications to the app on Android and iPhone | Global |
| Apple (Apple Push Notification service, through Firebase) | Delivering notifications to iPhones | Global |
| Razorpay | Billing for OkBell's own plans in India | India |
| Stripe | Billing for OkBell's own plans outside India | Global |
| Plivo | Voice calls for Family care check-ins and alerts, when calls are switched on | India region |
| Apple and Google (in-app purchases) | Selling personal plans in the apps. They are the seller of the purchase and responsible for its data | Global |
| Thaja Growth (thaja.org, the shared service of Newtact and Thaja for offer and partner codes) | Checks offer and partner codes. It receives only a keyed code made from the account and the code typed, no name, email or phone | Global (Cloudflare) |
| Google Maps Platform | Place search on Android, when saved places are available. It receives the search text a person types, sent from their phone | Global |
For transparency: no personal data
- OpenTimestamps. Once an hour, one hash of the Just in case record is sent to public OpenTimestamps servers. A hash is a short fingerprint; it holds no personal data and nothing can be read from it.
- OpenStreetMap. Map data for place reminders is downloaded from public sources to build our own map tiles. No user data is sent to OpenStreetMap.
Not our sub-processors
- A business's own payment provider (for example Razorpay, Cashfree, Stripe, Ziina, Mamo, Telr or GoCardless). Payers pay into the business's own account with its own provider. That provider works for the business, under the business's own contract.
- A business's own WhatsApp account. If a business connects its own WhatsApp number, Meta is the business's own provider for those messages.
Changes and notice
- We give at least 30 days' notice before we add or replace a sub-processor that handles personal data.
- Businesses get the notice by email to the account owner, and we update this page.
- A business may object within those 30 days, as our data processing agreement explains.
- Anyone else who wants to be told of changes, or has a question about this list, can write to hello@okbell.app.