Sub-processors
v1.0 · Effective 1 August 2026 · Last updated 29 July 2026
This document is published in English only. The English version is the one that applies.
In plain English
We do not run every part of Vaadify ourselves. Other companies host it, store the files, sign you in, take the payments and send the messages.
This page names every one of them, what it does, and which country the data sits in. Some of it is outside India.
We publish a change here before a new company starts handling your data, so this page is the place to watch.
A summary to help you read this. It is not the agreement — the sections below are.
Who touches your data, and where
| Company | What it does for us | Where the data sits |
|---|---|---|
| Neon | The Postgres database — every order, customer, product and document record | Singapore (ap-southeast-1) |
| Render | Runs the application itself | Singapore |
| Cloudflare | R2 object storage for uploaded images and files; DNS; cookieless website analytics; the network everything passes through | Cloudflare's global network. Object storage is held in Cloudflare's Asia-Pacific region |
| Clerk | Sign-in, user identity and session security. Holds names, email addresses and passwords for the people in your workspace | United States |
| Razorpay | Takes your subscription payments, and the payments your own customers make through links you generate. Holds card, UPI and bank details — we never see them | India |
| Resend | Sends transactional email: invoices, receipts, reminders, notices. Sees the recipient address and the content of the message | Japan (Tokyo), on Amazon Web Services |
| Sentry | Error monitoring. Receives a report when something breaks, which can occasionally include personal data that was on the screen at the time | United States |
| Meta (WhatsApp Cloud API) | Delivers WhatsApp messages. Under our model your own WhatsApp Business account is the sender | Meta's global infrastructure, principally the United States |
About WhatsApp, specifically
Vaadify does not send WhatsApp messages from an account of ours. It sends them from your WhatsApp Business account, which you connect yourself.
That means your agreement for WhatsApp is with Meta, not with us. Meta is your counterparty for those messages, their policies apply to you directly, and the message content passes through Meta's systems under your account. We pass the message to Meta on your instruction and record whether it was delivered.
About Razorpay, specifically
Razorpay appears twice in your life with Vaadify.
- You paying us. Razorpay takes your subscription payment. It holds your card or bank details. We only ever receive confirmation that a payment succeeded or failed, plus a reference number.
- Your customers paying you. Where you generate a payment link, your customer pays through Razorpay under your own arrangement with them. We never hold your customers' money, and we never see their card details either.
Data leaving India
Most of this list is outside India. That is stated here rather than implied.
The Digital Personal Data Protection Act, 2023 permits personal data to be transferred outside India except to countries the Government of India has restricted. None of the countries above is currently restricted.
If you record your customers' government identity documents, they are encrypted with AES-256-GCM before they are written to the database, so the copy that sits in Singapore is unreadable without the key. The key is held by the application, not by the database provider.
Companies that see nothing
For completeness, some services we use never touch your shop's data at all: source-code hosting, our own error dashboards for the marketing site, and the tools we build with. They are not on the list above because there is nothing on them to disclose.
When this list changes
Before a new company starts handling your data, we publish it here, with a new version number and date at the top of the page, at least 30 days in advance.
There is no mailing list to join. This page is the notice — it is dated, and its whole history is public, so you can see exactly what changed and when. That is a promise one small company can actually keep, which is why we made it rather than promising to email every shop individually.
If you object to a new sub-processor on reasonable grounds, write to [email protected] within those 30 days. If we cannot resolve it, you may cancel without penalty for the remainder of your paid period.
One exception, and we would rather write it down than rely on it quietly. If a company on this list stops trading, is withdrawn, suffers a serious failure, or must be replaced urgently to keep the service running or secure, we may replace it with less than 30 days' notice. We will publish the change here as soon as we make it and tell you what happened. The same right to object and cancel applies afterwards instead of before.
Where this fits
This page is referred to by the Terms of Service, the Privacy Policy and the Data Processing Agreement, and forms part of each of them.
Questions about anything on it: [email protected].