Sub-processors

This page lists the third-party service providers ("Sub-processors") that Tyto Labs Pte. Ltd. [UEN: 202621053Z] engages to deliver PropPal Executive Assistant ("PropPal CRM"). Each Sub-processor is contractually bound to use personal data only as instructed by us and to maintain reasonable security and confidentiality measures.

For full context, please read our Privacy Policy and our Data Processing Addendum.

1. Current Sub-processors

1.1 Infrastructure and connectivity

Sub-processor	Purpose	Data processed	Location
Supabase Inc. Privacy	Primary database, authentication, and file storage for the Service.	Account data, CRM records, WhatsApp messages and metadata, AI outputs, audit logs.	United States (AWS)
Cloudflare, Inc. Privacy	Webhook receiver, edge hosting, DNS, and DDoS protection.	Inbound webhook payloads, IP addresses, request metadata.	Global edge network
Vercel, Inc. Privacy	Hosting and serving the PropPal CRM web application and API routes; all authenticated HTTP traffic passes through Vercel; region pinned to sin1 (Singapore).	HTTP request/response data including authentication tokens and API payloads containing personal data in transit.	United States (platform); Singapore sin1 (serving edge)
Resend Privacy	Transactional email delivery — account notifications, billing receipts, breach notifications, digest emails, auth emails (also Supabase Auth's SMTP provider, white-label configured).	Email addresses, email content.	United States
Inngest, Inc. Privacy	Background job queue for AI analysis, WhatsApp backsync processing, lead scoring, and async workflows; job payloads include message content and CRM data.	Job payloads including WhatsApp message content, contact metadata, CRM records, AI prompt inputs/outputs during processing.	United States
Functional Software, Inc. (Sentry) Privacy	Application error monitoring and performance tracing, used to detect, diagnose, and fix faults in the Service.	Error events and stack traces containing system identifiers (such as agent, contact, and request IDs). No message content or User Content bodies are sent.	European Union (Frankfurt)
Upstash, Inc. Privacy	Managed Redis used for API rate limiting and abuse protection.	Rate-limiting keys only (such as agent and contact identifiers). No message content or User Content bodies are sent.	Singapore (AWS ap-southeast-1)

1.2 Messaging and integration

Sub-processor	Purpose	Data processed	Location
Meta Platforms, Inc. WA Business Terms	WhatsApp Business Cloud API — sending and receiving messages on your behalf as a Tech Provider.	WhatsApp messages, attachments, contact phone numbers, chat history, delivery / read receipts.	United States / European Union
Google LLC Privacy	Google Calendar API — your appointments in a separate, app-created "PropPal" calendar, following changes you make to them in Google, and, if you choose, showing you the events in your main Google Calendar.	Event IDs and times of your PropPal appointments, the sync bookmark and change-notification channel, OAuth tokens. Events from your other calendars are read when shown and not stored.	United States

1.3 AI services

Sub-processor	Purpose	Data processed	Location
OpenAI, L.L.C. Privacy	AI generation of summaries, drafts, qualification outputs, and Lead Concierge auto-replies.	Message content, prompts, contact metadata, CRM records, tone of voice samples.	United States
Anthropic, PBC Privacy	AI generation of summaries, drafts, qualification outputs, and Lead Concierge auto-replies (Claude models).	Message content, prompts, contact metadata, CRM records, tone of voice samples.	United States

OpenAI and Anthropic do not use content sent through their APIs to train or improve their general-purpose AI models. Content is processed only to generate a result; each provider may retain a copy for a limited period (generally up to around 30 days) for abuse monitoring, after which it is deleted. This AI processing currently takes place in the United States.

1.4 Payments

Sub-processor	Purpose	Data processed	Location
Stripe Payments Asia, Pacific Pte. Ltd. Privacy	Subscription billing, payment processing, invoicing, and refund handling.	Billing contact details, transaction records, payment confirmations. Stripe handles full payment card data; we do not store full card numbers.	Singapore / United States

1.5 Product analytics

Sub-processor	Purpose	Data processed	Location
PostHog, Inc. Privacy	Product analytics — feature usage events, session attribution, basic device / browser information.	Page views, feature events, session duration, device type, browser type, IP address (transient).	European Union (PostHog EU Cloud)
Google LLC (Google Analytics) Privacy	Aggregated traffic measurement on the public marketing website only (proppalcrm.com), not the in-product Service.	Aggregated visitor counts, referrer, device class.	United States
Microsoft Corporation (Clarity) Privacy	Heatmaps and session recordings on the public marketing website only (proppalcrm.com), not the in-product Service. Form field values are masked by default.	Page interactions, scroll depth, click locations, device type, browser type.	United States

2. Hosting and access regions

2.1 PropPal CRM's primary database (Supabase) is hosted in the United States. Personal data may also be processed in the European Union, Singapore, and other countries where our Sub-processors operate, as set out above.

2.2 Where personal data is transferred outside Singapore, Tyto Labs takes steps intended to ensure that the recipient is subject to legally enforceable obligations to provide a standard of protection comparable to that required under the Singapore Personal Data Protection Act 2012, as further described in our Privacy Policy.

3. Vendor due diligence

Before engaging a Sub-processor that will process User Content, Tyto Labs performs reasonable due diligence on the vendor's security and privacy practices, and contractually binds the vendor to obligations no less protective than those in our Privacy Policy and Data Processing Addendum.

4. Changes to this list

4.1 We will provide at least 7 days' advance notice on this page before adding or replacing a Sub-processor that processes User Content. The "Last updated" date at the top of this page indicates when this list was last revised.

4.2 To receive notifications of changes, email support@proppalcrm.com with the subject "Subscribe to sub-processor updates".

4.3 If you object to a new Sub-processor on reasonable grounds (such as a documented security concern), you may notify us within 7 days of the announcement. We will discuss the objection in good faith and, where the objection cannot be resolved, you may terminate your subscription in accordance with our Terms of Service. No pro-rated refund will apply to fees already paid.

5. Contact

For questions about our Sub-processors, please contact:

Tyto Labs Pte. Ltd.
[UEN: 202621053Z]
doing business as PropPal Executive Assistant ("PropPal CRM")
Email: support@proppalcrm.com
Data Protection Officer: support@proppalcrm.com (subject line "Attention: Data Protection Officer")