Sub-processors
Last updated: 21 October 2026
The companies that process personal data for us when you use Flowella: what each one does, the data involved and where it is processed.
On this page
1. Who this list covers
When a business uses Flowella to talk to its customers on WhatsApp, the business decides how that data is used, and Flowella Limited processes it on the business’s instructions. The providers on this page help us run Flowella. Each one processes personal data only to provide its part of the Service, under its data processing terms with us.
The list has three parts: the sub-processors that handle our customers’ data, how WhatsApp messages travel through Meta, and the tools we use to run our own website and app. Our privacy policy explains the rest of how we handle personal data.
2. Sub-processors for customer data
These providers handle the data our customers put into Flowella, or that their contacts send on WhatsApp.
| Provider | What it does for Flowella | Personal data involved | Where | When it applies |
|---|---|---|---|---|
| Microsoft Azure | Hosts the Flowella app, API, database, file storage and logs | Everything Flowella stores: account users, contacts, messages, Flow responses and files | United Kingdom: UK South (London), with copies of stored files in UK West (Cardiff) | Always |
| Sentry | Error monitoring, and session replays with on-screen text masked | Account users’ names and email addresses; error details, which can include a contact’s number or a message | Germany (Frankfurt) | Always |
| Resend | Sends service emails, such as sign-in links, invitations and notifications | Account users’ names and email addresses; email content, which can include a contact’s name or number | Ireland for sending; the company is in the United States | Always |
| Stripe | Subscriptions, invoices and payments | Billing contacts and addresses, payment details entered with Stripe, and counts of billable messages (no message content) | United States and other Stripe locations | Always |
| OpenAI | Reads the documents you send to the AI Document Reader workflow action, and analyses photos for an AI image feature built for one customer | The documents or photos sent to these features, which can include identity documents | United States | Only when these features are used |
| Cloudinary | Stores the images made by that AI image feature | Generated images and the person’s name | United States | Only for that feature |
3. WhatsApp messages and Meta
WhatsApp messages are carried by Meta’s WhatsApp Business Platform (Cloud API). You connect your own WhatsApp Business Account and accept Meta’s WhatsApp Business terms directly with Meta. Under those terms Meta processes message data as your service provider, and Flowella sends and receives messages through your account on your instructions.
Meta keeps Cloud API message data for up to 30 days and may process it in its data centres around the world, including the United States. Meta’s WhatsApp Business UK Data Transfer Addendum covers transfers from the UK. We list Meta here so the picture is complete, but it is your provider rather than a sub-processor we appoint.
4. Tools for our own website and app
We also use these tools to run Flowella as a business. They handle data about visitors to our websites and about the people who use the Flowella app. Our cookie policy lists the cookies they set.
| Provider | What it does | Where |
|---|---|---|
| Google (Tag Manager and Analytics) | Website and app analytics | Global, including the United States |
| Hotjar | Heatmaps and session recordings | Ireland |
| HubSpot | Our website, forms, CRM and marketing email | EU data centre, with access from the United States |
| Apollo.io | Identifies the companies that visit our website | United States |
| Microsoft 365 | Our email and team messaging | Microsoft’s data centres |
| Mintlify | Hosts our help centre, knowledge.flowella.io | United States |
5. International transfers
Flowella stores your data in the United Kingdom. Some of the providers above process personal data elsewhere: in the European Economic Area (Sentry in Germany; Resend sends email from Ireland) and in the United States (Stripe, OpenAI and Cloudinary when their features are used, and support access by some US-based providers).
Transfers to the European Economic Area rely on the UK’s adequacy regulations. Transfers to the United States rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
6. Changes and questions
We change the date at the top of this page whenever the list changes. For questions about our sub-processors, or to ask for a data processing agreement, email privacy@flowella.io.