Sub-processors

1.What a sub-processor is

When we process personal data on behalf of a customer, we act as a processor. A sub-processor is a third party we engage that may in turn process that data in order for us to deliver the service.

This page supports our Data Processing Addendum, which requires us to keep an accurate list available and to give notice before the list changes.

2.Messaging channel providers

These are unavoidable: a message cannot reach a WhatsApp or Instagram user without passing through the channel that owns that network. They receive the message content and the recipient identifier.

• Meta Platforms, for WhatsApp Business, Instagram and Messenger delivery.
• Telegram, for Telegram bot and channel messaging.
• TikTok, for TikTok messaging and comment handling.

3.Infrastructure providers

• Cloud hosting and edge network, for running the application and serving it worldwide.
• Managed database and object storage, for conversation history, contact records and attachments.
• Logging and application monitoring, for diagnostics, alerting and abuse detection.

4.Platform service providers

• AI model provider, processing only the conversation context needed to generate a suggested reply, summary or chatbot answer.
• Transactional email provider, for account, billing and service notifications.
• Payment provider, for subscription billing. They receive billing contact and payment details; we do not store full card numbers.
• Support and ticketing tooling, where you contact our team and the correspondence is stored.

5.How we select and govern them

Before engaging a sub-processor we assess its security posture, data-protection commitments, transfer mechanisms and track record. Each is engaged under written terms imposing obligations no less protective than those in our own DPA, and we remain fully liable to our customers for their performance.

Access is limited to what the vendor needs to perform its function. We review the list periodically and remove vendors we no longer use.

6.Location and transfers

Our sub-processors operate in the United Arab Emirates, the European Economic Area, the United Kingdom, the United States and other jurisdictions depending on the service. Where personal data is transferred across borders we rely on an adequacy decision, standard contractual clauses or another lawful transfer mechanism, supported by encryption in transit and at rest.

7.Notice of changes and objection

We will give customers at least 30 days' notice before adding or replacing a sub-processor that will process their personal data. To receive those notices, ask us to add your compliance contact to the notification list.

A customer may object on reasonable data-protection grounds within the notice period. We will work with you to find a solution; if we cannot resolve the objection, you may terminate the affected service without penalty, as set out in the DPA.

8.Current list and questions

This page describes the categories of sub-processor and the purpose of each. For the current list naming specific entities and their processing locations, for example to complete a vendor assessment, email ceo@alabrishtechnologies.com and we will provide it.