Sub-processors

Supabase — Application database (primary data store)

Data: All customer and end-user data stored in OpDash — account, contacts and leads, conversations, billing records
Location: EU (Ireland)

Vercel — Application hosting and edge network

Data: Request metadata and client IP address at the edge; application traffic
Location: Global edge; OpDash functions pinned to the EU (Ireland)

Anthropic — AI model that generates assistant replies

Data: Conversation content sent to the model to produce a reply
Location: United States

Voyage AI — Text embeddings for knowledge search

Data: Content of a customer's ingested documents and website, converted to embeddings
Location: United States

ElevenLabs — Voice for the phone assistant: it turns the caller's speech into text and the assistant's replies into speech, and summarises each call

Data: Calls with the phone assistant: the audio, the caller's phone number and the transcript. After each call it lists the details the caller gave and writes a short summary. ElevenLabs keeps a recording and a transcript of each call for two years.
Location: United States

Stripe — Payments, subscriptions, and tax

Data: Billing and payment details, business contact information, tax data
Location: United States / EU (Stripe Payments Europe)

Cloudflare — Bot protection at signup (Turnstile)

Data: Client IP address and a challenge token, to distinguish humans from bots at signup
Location: Global

Upstash — Rate-limiting and abuse-prevention store

Data: Short-lived rate-limit counters keyed by hashed IP / session token (no raw IP)
Location: EU

Sentry — Application error monitoring

Data: Exception and diagnostic payloads (request id, opaque ids, hashed IP — no raw personal data by design)
Location: EU (Germany)

Axiom — Application logging

Data: Structured log lines (request id, hashed IP — no raw personal data by design)
Location: EU

PostHog — Product analytics

Data: Named funnel events plus autocaptured page interactions and heatmaps; sets a cookie and uses local storage. Loaded only after the visitor accepts statistics cookies.
Location: EU Cloud

UptimeRobot — Uptime monitoring and alerting

Data: Your team's alert-contact email; pings a public health URL
Location: United States / EU

Resend — Transactional and marketing email

Data: Recipient email addresses — signup confirmation and password-reset email for your OpDash account, and the marketing site (opdash.co) mailing list
Location: United States (messages are sent from the EU/Ireland region)

Amazon SES (AWS) — Notification email from the application, such as an alert to your team about a new lead or a new booking, and, when booking emails are switched on, emails to your customers about their bookings

Data: Recipient email addresses, and the personal details in the email, such as a lead's contact details or a customer's name and booking
Location: EU (Ireland)

Twilio — Phone numbers, phone calls, text messages and WhatsApp messages

Data: Callers' phone numbers and the calls it carries to the phone assistant; the text messages sent to callers after a call; the WhatsApp alerts sent to your team, with the details the caller gave, such as their name, phone number, address and the reason for the call; a check of whether a caller's number is a mobile. The WhatsApp alerts are delivered through Meta's WhatsApp service, under Meta's own terms.
Location: United States