How to read this disclosure
A subprocessor is another service provider engaged by us to process Customer Personal Data on Customer’s behalf. Some providers are conditional: they receive data only when Customer enables the relevant integration or when the operator configures that service.
Meta and Razorpay may also act independently under their own terms for parts of their relationship with Customer. Listing a provider here does not change its legal role for a specific processing activity.
Active and feature-dependent providers
| Provider | Purpose | When used |
|---|---|---|
| Meta Platforms, Inc. and applicable affiliates | WhatsApp Business account onboarding, template and message API, delivery status, and inbound messages | Only when Customer connects and uses WhatsApp |
| Razorpay Software Private Limited and applicable affiliates | Subscription checkout, recurring payment, payment status, refund, and reconciliation | Only when paid billing is enabled and used |
| Production infrastructure provider selected by the SendInbox operator | VPS compute, networking, disks, and datacentre services | Active for the production service; provider legal identity is available to contracted Customers on request |
Operator-configured providers
| Category | Purpose | Current condition |
|---|---|---|
| SMTP email provider | Account verification, password reset, invitations, and service notices | No provider receives data until production SMTP is configured |
| Functional Software, Inc. (Sentry) | Optional error and performance telemetry with default PII disabled | No data is sent unless a production Sentry DSN is configured |
| Independent backup storage provider | Encrypted off-host disaster-recovery copies | Not yet configured; current backups remain on the production VPS |
SendInbox-operated processing
The application, PostgreSQL database, Redis queue, background workers, and private S3-compatible object store currently run within the SendInbox-operated production environment. These components are not separate third-party subprocessors. Internet traffic reaches the application through an operator-managed TLS reverse proxy; database, Redis, and private storage are not directly published.
Changes and objections
We will update this page before a material new routine subprocessor begins processing where reasonably possible. Customers may periodically review it or ask to be notified through their contractual contact. A Customer may object on reasonable data-protection grounds by emailing support@sendinbox.co.
We will consider a reasonable alternative. If no alternative is commercially and technically practical, either party may discontinue the affected feature under the DPA. Provider countries and infrastructure can change; no data-residency promise applies unless included in a signed order.