The companies involved in processing your data
Saying you protect data without saying whose hands it passes through is not worth much. Here is, by category, what each one sees and where it hosts it; names are provided on request. The list is dated and changes when the arrangement changes.
How to read this list
A subprocessor is a company that processes data on our behalf, on our instructions, without making its own use of it. Each is bound by a contract that forbids it to use that data for other purposes and obliges it to report any breach to us.
The what it sees column is the part that counts. It is deliberately restrictive: we developed the platform so that most of these providers never see the content of a conversation, and for most of them, never your identity either.
This list describes the arrangement at the platforms' launch. Any provider added or any change of role is published here, dated, and announced in the news when it touches content or identity.
This page names categories and countries, not companies: saying publicly who runs each part would amount to publishing the plan of the installation. The dated, named list is provided on written request to [email protected], and to any data protection authority that asks for it.
Inference: the models that answer
This is the only category that sees the text of your exchanges. It is therefore handled separately, with the detail of the instructions we pass on.
| Category | Role | What it sees | Established in |
|---|---|---|---|
| Inference gateway | Routes each request to the model chosen by our routing logic. | The text of the request and of the answer, with your first name and the profile you filled in. No account identifier: no phone number, no address, no user identifier. | United States |
| Model labs established in the United States | Inference models; several labs, chosen according to the task. | The text passed on by the gateway, without number or address. | United States |
| Model labs established in China | Inference models; several labs, chosen according to the task. | The text passed on by the gateway, without number or address. | China |
Payment
These providers see a transaction. None of them has access to the content of your conversations, and we never store a card number on our side.
| Category | Role | What it sees | Established in |
|---|---|---|---|
| Mobile money payment aggregator | Mobile money collection in Kenya (M-Pesa) at launch, then in each country as it opens. | Your phone number, the amount, the currency and a transaction reference. | United States |
| MVola operator | Mobile money collection in Madagascar (MVola), through a direct integration, from launch. | Your phone number, the amount and a transaction reference. | Madagascar |
| Card payment provider | Card collection, in countries without mobile money and everywhere in the world. | Your card details, which it alone keeps, the amount and the currency. | United States and Ireland |
Sign-in and notifications
These providers help you sign in or notify you. None of them sees the content of your conversations. An account can hold both a WhatsApp number and an email address; you then sign in with either.
| Category | Role | What it sees | Established in |
|---|---|---|---|
| WhatsApp (Meta) | Sends the sign-in code by WhatsApp, and the code that links a number to an account created by email. | Your phone number and the six-digit code. | Ireland and United States |
| Code by email | Sends the sign-in code by email, and the code that links an address to an account created by WhatsApp; goes through the email delivery service listed below. | Your email address and the six-digit code. | United States |
| Browser notification services (Google, Mozilla, Apple) | Delivery of web chat notifications, answer ready and weekly reminder, if you allow them. | A browser subscription identifier and the encrypted message of the notification. | United States |
| Email notifications | Answer ready, weekly reminder, renewal notice, if you enable them in settings; go through the email delivery service listed below. | Your email address and the title of the notification, never the content of a conversation. | United States |
Infrastructure and operations
| Category | Role | What it sees | Established in |
|---|---|---|---|
| Server host | Server and database of the platforms. | Everything that is stored, on an encrypted disk. It is the only host of the database. | European Union |
| Domain name and protection service | Domain names, site delivery, protection against attacks. | The network addresses of incoming connections. No application content. | United States |
| Backup storage | Database backups, encrypted before sending. | Encrypted archives whose key it does not hold. | United States |
| Email delivery service | Service messages: sign-in codes, debit notices, alerts. | Your email address and the content of those messages. | United States |
| Web search engines | When a question needs recent facts, the rephrased question is sent to a search engine; a second one takes over if the first does not answer. | The rephrased question alone. No identifier, no history, none of the rest of the conversation. | United States |
Transfers outside your country
Your data leaves your country. There is no honest way to present it otherwise: the infrastructure is in Europe, the inference providers are in the United States and in China, and none of the countries where we operate hosts that whole chain today.
What we do to keep that transfer framed: standard contractual clauses with each provider, sending only your first name with the content to inference, never an address or number, and encryption in transit across every link.
What we do not claim: that these safeguards are equivalent to local hosting. They are not. A platform hosted in your country would be preferable on that precise point, and it is something we will look at when the volume warrants it.
A provider added or removed is the subject of a dated update to this page.