Legal

Sub-processors

Last updated 24 September 2026 · Version 2026-09-24

These are the providers that process personal data on our behalf to run OpusFunnel, including the data our customers put into it. This page is Annex 3 of our Data Processing Addendum.

Change notice. We will update this page and email every account owner at least 30 days before we add or replace a sub-processor. Customers may object under section 5 of the DPA. To have notices also sent to another address, such as your data protection contact, write to support@opusfunnel.com.

Sub-processors Which features use which WhatsApp and Meta Other recipients

Sub-processors

Provider	What it does for us	Personal data involved	Where	Contract and transfer safeguard
Supabase	Database, sign-in, file storage and server functions	All data held in OpusFunnel	United States (AWS us-west-1, California)	DPA incorporated in Supabase's terms (contracting entity Supabase Pte. Ltd., Singapore); SCCs, with UK and Swiss addenda. Not DPF certified.
Google Cloud	Runs the web app (Cloud Run)	Everything the app handles in transit; request logs, including IP addresses	United States (us-central1, Iowa)	DPA incorporated in Google Cloud's terms (Cloud Data Processing Addendum); DPF certified (EU, UK, Swiss)
Cloudflare	Delivers our websites and customers' published pages; security; custom domains	Web traffic: IP addresses, request headers, cookies	Global network	DPA incorporated in Cloudflare's terms; DPF certified (EU, UK, Swiss); SCCs, with UK Addendum and Swiss terms
Stripe	Our subscription billing and wallet top-ups; payments customers take through their own Stripe accounts	Names, email addresses, phone numbers, billing and shipping addresses, payment details (held by Stripe)	United States and other countries	DPA incorporated in Stripe's terms (Stripe, LLC for US accounts); DPF certified (EU, UK, Swiss); SCCs and UK Addendum
Resend	Sending and receiving email	Email addresses, email content, inbound email	United States (us-east-1)	DPA incorporated in Resend's terms (Plus Five Five, Inc.); DPF certified (EU and UK, not Swiss); SCCs, with UK Addendum and Swiss terms
Telnyx	Phone numbers, SMS, WhatsApp, calls, the AI phone agent (speech, language model and voice), US texting registration	Phone numbers, message content, call audio, recordings, transcripts, business registration details	United States (Telnyx's primary processing facilities)	DPA incorporated in Telnyx's terms (Telnyx LLC); DPF certified (EU, UK, Swiss); SCCs and UK Addendum
Zernio	Social publishing, the social inbox, ads, ad audiences and lead forms	Post and reply text; commenters' names, handles and messages; lead-form names, emails and phone numbers; email addresses and phone numbers uploaded to ad audiences	Spain-based company. Zernio states its databases are in France and the UK, its API runs in the UK and some logs are kept in the United States	DPA not public: Zernio (ZERNIO SOFTWARE SL, Spain) provides it on request through its trust center, and states it relies on SCCs or adequacy decisions for transfers. DPF does not apply to an EU company.
Anthropic	AI text features (Claude models)	AI prompts, which can include contact details, messages, reviews, comments and form answers	United States	DPA incorporated in Anthropic's Commercial Terms; SCCs, with UK and Swiss addenda. Not DPF certified.
OpenAI	AI images, text embeddings for search, some AI text	Uploaded images and logos; message text, callers' questions and knowledge-base documents	United States	DPA incorporated in OpenAI's Services Agreement; SCCs (EU and Swiss data through OpenAI Ireland; UK Addendum for UK data). Not DPF certified.

"SCCs" means the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data). "DPF" means the EU-US Data Privacy Framework and its UK and Swiss extensions, where the provider is certified.

Which features use which

Every account uses Supabase, Google Cloud, Cloudflare and Resend.
Stripe is used for billing, and for payments once you connect your Stripe account.
Telnyx is used only if you use phone numbers, texting, WhatsApp or the AI phone agent.
Zernio is used only if you connect social accounts or use ads or lead forms.
Anthropic and OpenAI are used only when you use AI features. Agencies can switch AI off for a client account.

WhatsApp and Meta

WhatsApp messages are carried by Meta on its WhatsApp Business Platform, and pass between OpusFunnel and Meta through Telnyx. A number is connected to WhatsApp through Meta's business sign-up, which our support runs with the business. Meta's own WhatsApp Business Platform terms, which include its terms for processing message content for the account holder, govern the WhatsApp Business Account that sign-up creates and are accepted by the Meta business account that completes it.² To find out which Meta business account a number's WhatsApp Business Account belongs to, ask support@opusfunnel.com. WhatsApp is used only if you connect a number to it.

Other recipients that are not our sub-processors

Some features send data to organisations that act for themselves or for you, not for us:

PayPal sends partner payouts: for our own partner program and, through the customer's own PayPal account, for customers' affiliate programs. It receives the payee's email address, the amount and a payout note. PayPal acts as an independent controller for Payouts under its own privacy statement; its public Data Protection Addendum covers card processing, not Payouts.¹
The Campaign Registry and US mobile carriers receive your business registration details, and carriers carry your texts, as the telephone network requires.
Social and ad networks you connect (such as Meta, Google, TikTok and LinkedIn) receive what you publish and the audience lists you upload, under your own accounts and their terms.
Google receives sign-in data if you sign in with Google, and visitors' IP addresses when the pages of our marketing website (opusfunnel.com) load Google Fonts. The app and the pages our customers publish serve fonts from our own servers.
YouTube and Vimeo receive visitors' data when a page you publish embeds their video.
Services you connect by webhook, such as Zapier, receive the contact fields you choose to send.
Your own Stripe account and its payment data are governed by your agreement with Stripe.

Stock photo search (Unsplash) receives search words only, not personal data.

Sources, read 24 September 2026: ¹ PayPal, privacy statement for merchants ("an independent data controller for most of our products and services") and Data Protection Addendum. ² Meta, Terms for WhatsApp Business Platform, which incorporate the Meta Global Processor Terms.

Version history: 2026-09-24, first published version.

Contact

Questions about our sub-processors: support@opusfunnel.com.