Sub-processors

This page lists the third-party service providers ("Sub-processors") that Tyto Labs Pte. Ltd. [UEN: 202621053Z] engages to deliver PropPal Executive Assistant ("PropPal EA"). Each Sub-processor is contractually bound to use personal data only as instructed by us and to maintain reasonable security and confidentiality measures.

For full context, please read our Privacy Policy and our Data Processing Addendum.

1. Current Sub-processors

1.1 Infrastructure and connectivity

Sub-processor	Purpose	Data processed	Location
Supabase Inc. Privacy	Primary database, authentication, and file storage for the Service.	Account data, CRM records, WhatsApp messages and metadata, AI outputs, audit logs.	United States (AWS)
Cloudflare, Inc. Privacy	Webhook receiver, edge hosting, DNS, and DDoS protection.	Inbound webhook payloads, IP addresses, request metadata.	Global edge network
Vercel, Inc. Privacy	Hosting and serving the PropPal EA web application and API routes; all authenticated HTTP traffic passes through Vercel; region pinned to sin1 (Singapore).	HTTP request/response data including authentication tokens and API payloads containing personal data in transit.	United States (platform); Singapore sin1 (serving edge)
Resend Privacy	Transactional email delivery — account notifications, billing receipts, breach notifications, digest emails, auth emails (also Supabase Auth's SMTP provider, white-label configured).	Email addresses, email content.	United States
Inngest, Inc. Privacy	Background job queue for AI analysis, WhatsApp backsync processing, lead scoring, and async workflows; job payloads include message content and CRM data.	Job payloads including WhatsApp message content, contact metadata, CRM records, AI prompt inputs/outputs during processing.	United States

1.2 Messaging and integration

Sub-processor	Purpose	Data processed	Location
Meta Platforms, Inc. WA Business Terms	WhatsApp Business Cloud API — sending and receiving messages on your behalf as a Tech Provider.	WhatsApp messages, attachments, contact phone numbers, chat history, delivery / read receipts.	United States / European Union
Google LLC Privacy	Google Calendar API (Pro tier) — conflict detection and event creation in a separate "PropPal Viewings" calendar.	Event metadata (start time, end time, busy / free status); OAuth tokens.	United States

1.3 AI services

Sub-processor	Purpose	Data processed	Location
OpenAI, L.L.C. Privacy	AI generation of summaries, drafts, qualification outputs, and Lead Concierge auto-replies.	Message content, prompts, contact metadata, CRM records, tone of voice samples.	United States (zero-retention API)
Anthropic, PBC Privacy	AI generation of summaries, drafts, qualification outputs, and Lead Concierge auto-replies (Claude models).	Message content, prompts, contact metadata, CRM records, tone of voice samples.	United States (zero-retention API)

OpenAI and Anthropic are configured with zero-retention API endpoints where available. They do not train or improve their general-purpose AI models on your content.

1.4 Payments

Sub-processor	Purpose	Data processed	Location
Stripe Payments Asia, Pacific Pte. Ltd. Privacy	Subscription billing, payment processing, invoicing, and refund handling.	Billing contact details, transaction records, payment confirmations. Stripe handles full payment card data; we do not store full card numbers.	Singapore / United States

1.5 Product analytics

Sub-processor	Purpose	Data processed	Location
PostHog, Inc. Privacy	Product analytics — feature usage events, session attribution, basic device / browser information.	Page views, feature events, session duration, device type, browser type, IP address (transient).	United States (PostHog US Cloud)
Google LLC (Google Analytics) Privacy	Aggregated traffic measurement on the public marketing website only (proppalcrm.com), not the in-product Service.	Aggregated visitor counts, referrer, device class.	United States

2. Hosting and access regions

2.1 PropPal EA's primary database (Supabase) is hosted in the United States. Personal data may also be processed in the European Union, Singapore, and other countries where our Sub-processors operate, as set out above.

2.2 Where personal data is transferred outside Singapore, Tyto Labs takes steps intended to ensure that the recipient is subject to legally enforceable obligations to provide a standard of protection comparable to that required under the Singapore Personal Data Protection Act 2012, as further described in our Privacy Policy.

3. Vendor due diligence

Before engaging a Sub-processor that will process User Content, Tyto Labs performs reasonable due diligence on the vendor's security and privacy practices, and contractually binds the vendor to obligations no less protective than those in our Privacy Policy and Data Processing Addendum.

4. Changes to this list

4.1 We will provide at least 7 days' advance notice on this page before adding or replacing a Sub-processor that processes User Content. The "Last updated" date at the top of this page indicates when this list was last revised.

4.2 To receive notifications of changes, email [email protected] with the subject "Subscribe to sub-processor updates".

4.3 If you object to a new Sub-processor on reasonable grounds (such as a documented security concern), you may notify us within 7 days of the announcement. We will discuss the objection in good faith and, where the objection cannot be resolved, you may terminate your subscription in accordance with our Terms of Service. No pro-rated refund will apply to fees already paid.

5. Contact

For questions about our Sub-processors, please contact:

Tyto Labs Pte. Ltd.
[UEN: 202621053Z]
doing business as PropPal Executive Assistant ("PropPal EA")
Email: [email protected]
Data Protection Officer: [email protected] (subject line "Attention: Data Protection Officer")