Subprocessors
Last updated: May 2026
This page lists key subprocessors that help OwnersPal deliver and operate the Service. These vendors may process personal or business data only as needed to provide infrastructure, billing, communications, security, and platform integrations.
| Vendor | Purpose | Data categories | Region |
|---|---|---|---|
| Supabase | Authentication and application data storage | Account profile data, auth identifiers, business profile data, generated content metadata | Global |
| Stripe | Subscription billing and payment processing | Billing identifiers, subscription status, payment metadata, invoicing records | Global |
| Resend | Transactional email delivery | Email address, message metadata, delivery and bounce events | US |
| Railway | Backend API hosting and runtime infrastructure | Application logs, request metadata, operational diagnostics | US |
| Vercel | Frontend hosting, delivery, and consented analytics | Site request metadata, performance telemetry, consented analytics events | Global |
| Sentry | Error monitoring and performance diagnostics | Error traces, technical diagnostics, limited request context | Global |
| Fal / model providers | Media generation and model inference pipeline | Uploaded media, prompts, generation job metadata, output references | Global |
| ElevenLabs (via Fal) | Voice-hook text-to-speech for video ads (opt-in feature; preset voices only, no voice cloning) | Short text strings derived from your business profile (business name, hours, CTA) sent for synthesis; no customer or review content | US |
| OpenAI | Text + vision inference for AI features (captions, image intelligence, content safety analysis) + website content extraction (menus, team, FAQ, About, customer testimonials) | Prompts, uploaded images submitted for composition + safety analysis, generated outputs, request and response metadata, website page text submitted for content extraction | US |
| Headless render endpoint (optional) | Renders JavaScript-only (single-page-app) business websites so we can read their menu and photos when the page injects content client-side. Off by default; only used when an operator configures a render endpoint, and only against the business's own public site. | The business's own public website URL (no personal data) | Global |
| Twilio | SMS and WhatsApp messaging delivery | Phone numbers, message content metadata, delivery and status events | Global |
| Google APIs (Business Profile, Ads, YouTube) | OAuth integrations and connected platform operations | OAuth tokens, connected account identifiers, campaign and posting metadata, Google Business Profile reviews (cached for the optional review-overlay feature when enabled by the owner) | Global |
| YouTube (embedded video) | When a business embeds its own YouTube video on its OwnersPal website, the visitor's browser loads the clip from YouTube. We use the privacy-friendly youtube-nocookie.com host, which doesn't set a tracking cookie until the visitor presses play. OwnersPal makes no server-side call to YouTube for this. | The visitor's IP address and request metadata (sent by the browser to load the embedded video); the public video ID | Global |
| Vimeo (embedded video) | When a business embeds its own Vimeo video on its OwnersPal website, the visitor's browser loads the clip from Vimeo's player (player.vimeo.com). OwnersPal makes no server-side call to Vimeo for this. | The visitor's IP address and request metadata (sent by the browser to load the embedded video); the public video ID | Global |
| Meta APIs (Facebook/Instagram) | OAuth integrations and connected platform operations | OAuth tokens, connected account identifiers, campaign and posting metadata | Global |
| Microsoft Ads | OAuth integrations and connected platform operations | OAuth tokens, connected account identifiers, campaign and conversion metadata | Global |
| Yelp | OAuth integrations and connected platform operations | OAuth tokens, connected business identifiers, review and listing metadata | US |
| TikTok | OAuth integrations and connected platform operations | OAuth tokens, connected account identifiers, post and engagement metadata | Global |
| Nextdoor | OAuth integrations and connected platform operations | OAuth tokens, connected business identifiers, post and reply metadata | US |
We update this list as vendors and subprocessors change.