Sub-processors

This is Annex 3 of the Alaaqat Data Processing Agreement. Changes to it are published on this page before a new Sub-processor starts processing Customer Data (DPA Section 6.2), and the Customer may object within 14 days of the notice (Section 6.3).

Sub-processor list version: 2026-09-21.

3.1 Sub-processors of Customer Data

Sub-processor	Purpose	Customer Data processed	Location	Transfer mechanism
Meta Platforms Ireland Ltd (WhatsApp Business Platform, Messenger Platform, Instagram Messaging API)	Delivery and receipt of messages on the channels the Customer connects	Message content and media in both directions; Contact phone numbers / platform IDs and profile names; GPS coordinates in location messages; Customer Data values the Customer interpolates into template messages; phone-book and history import under Section 4.4	Ireland / USA	EU–US Data Privacy Framework; Meta's SCCs. Note: Meta acts as an independent controller for parts of this processing under its own terms.
Amazon Web Services EMEA SARL (EC2, S3)	Hosting of the application servers and the PostgreSQL database; storage of files, media, voice notes, exports and encrypted backups	All Customer Data	Ireland (eu-west-1)	Hosted in the EEA; AWS Data Processing Addendum
MongoDB, Inc. (Atlas)	Managed database for objects, conversations, notes, activity logs	All Customer Data except relational account records	Ireland (AWS eu-west-1)	Hosted in the EEA; MongoDB Data Processing Agreement
Pusher Ltd (Channels)	Real-time delivery of updates to the Customer's browser sessions	Transient: new-message notifications carrying message content and the sender's name/avatar; record-change events. Not stored beyond delivery.	Ireland (EU cluster)	Hosted in the EEA; Pusher DPA
Google LLC — Maps Platform	Rendering a map for a Contact's shared location	GPS coordinates of a location message, sent from the user's browser to Google when the map is opened	USA	EU–US Data Privacy Framework; Google Cloud DPA
Google LLC — OAuth	Optional sign-in of the Customer's users with a Google account	User email and profile — user data, Section 2.2, not Customer Data; listed for completeness	USA	as above
Browser push services (Google FCM, Mozilla, Apple) via Web Push	Delivering desktop notifications to the Customer's users who opted in	Transient notification payloads: Contact name and a message preview	USA	The push endpoint is chosen by the user's browser vendor; payloads are encrypted end-to-end (RFC 8291) so the service cannot read them

3.2 Providers that process only user or billing data (Section 2.2 — Alaaqat as Controller)

Provider	Purpose	Data
Paddle.com Market Ltd	Merchant of record for subscriptions and invoicing	Account owner's name, email, billing address, payment method, invoices
MailerSend, UAB (Lithuania, EU data region)	Delivery of Alaaqat's own transactional email (sign-in, security, billing, deletion and dormancy notices)	Recipient name and email address, Account name; never Customer Data
Google LLC — Workspace (Gmail)	Support correspondence with the Customer's users	Sender name and email, Account name, and whatever the Customer chooses to write; the Customer should not paste Contact data into support requests
Google LLC — Tag Manager / Analytics	Website and in-app product analytics, only after analytics consent	Pseudonymous usage events, client ID; never Customer Data
Google / Meta / LinkedIn ad-click identifiers	Attribution of a signup to a campaign, only after marketing consent	`gclid`, `fbclid`, `li_fat_id`, `utm_*` stored on the Account; click IDs pruned after 90 days

3.3 Not Sub-processors

Email delivery tracking and debug tooling run inside Alaaqat's own infrastructure and are not third parties; their retentions are in Annex 4.

Change history

Date	Change
2026-09-21	Initial list, published with version 1.0 of the Data Processing Agreement (effective 1 October 2026).