Sub-Processors
Version 1.2.0 · Effective 29 August 2026
This page lists third-party service providers (“sub-processors”) we engage to deliver the Service. Each sub-processor processes personal data only on our documented instructions and only as needed to support the Service. We have a written data processing agreement (or equivalent contractual safeguards) in place with each sub-processor before any personal data is shared.
Current sub-processors
The following sub-processors are engaged as of the effective date above. We will provide Vendors at least 30 days’ advance notice in the Unisay dashboard before adding any new sub-processor that processes personal data. Vendors may object in writing during the notice period; if we cannot accommodate the objection, the Vendor’s exclusive remedy is to terminate the affected feature and receive a pro-rata refund of pre-paid fees.
| Provider | Jurisdiction | Service | Data categories | References |
|---|---|---|---|---|
| Neon, Inc. | United States & Singapore | PostgreSQL database hosting | All Vendor and Customer data at rest | DPA · Security |
| Render Services, Inc. | United States (Singapore region) | API server hosting | All data in transit during request processing | DPA · Security |
| Vercel, Inc. | United States | Web frontend hosting | Authentication tokens (in-browser); no personal data at rest | DPA · Security |
| Meta Platforms, Inc. | United States & Ireland | WhatsApp Business Platform; Instagram Platform (graph.instagram.com); Messenger Platform (graph.facebook.com Page Send/Receive); Catalog API; Facebook Login for Business; Conversions API for messaging-channel attribution | On all connected channels: Customer phone numbers (WhatsApp), Instagram-Scoped IDs and Page-Scoped IDs (Instagram Direct, Facebook Messenger), display profile names, message content (text and media — images, video, audio, documents, stickers), location coordinates when shared, reactions, quoted-reply context, and Click-to-WhatsApp ctwa_clid attribution identifiers. The Vendor’s own Meta Business Account ID, WhatsApp Business Account ID, phone-number ID, Facebook Page ID, Instagram Business account ID, and the long-lived access tokens issued at OAuth. | DPT · WA Business Solution · Privacy |
| Resend, Inc. | United States | Transactional email delivery (welcome, password reset, breach notifications, Meta-token-expiring warnings) | Vendor staff email addresses only; we do not transmit end-customer email through Resend | DPA · Privacy |
| Anthropic, PBC | United States | Claude AI model — assistant message generation, intent parsing, AI-as-judge quality scoring | Customer message content (across WhatsApp, Instagram Direct, and Facebook Messenger when those channels are enabled), product catalogue text, and conversation history (last 24 hours), only when AI Agent is enabled by the Vendor and Anthropic is selected as a provider or is the active step of the judge fallback chain. Zero data retention enabled with Anthropic. | AUP · Terms · Privacy |
| OpenAI, LLC | United States | GPT models — alternative AI provider when configured by the Vendor | Same scope as Anthropic above (cross-channel coverage); engaged only when Vendor selects OpenAI as the provider in AI Agent settings. API data is not used to train OpenAI models. | DPA · Privacy |
| Google LLC | United States | Gemini models & embedding API — semantic product search and AI assist | Product names and descriptions (for embeddings); customer message content across all enabled Meta Channels (when AI Agent provider is set to Google or Gemini is the active step of the judge fallback chain). | DPA · Privacy |
| Groq, Inc. | United States | Llama-family + GPT-OSS models — fastest-tier AI provider in the cost-first judge fallback chain (preserves the Vendor’s Gemini free quota for chat generation) | Customer message content across all enabled Meta Channels when Groq is the active step of the judge fallback chain. Engaged only when Vendor selects Groq or Vendor’s judge order has Groq first. No-training data position per Groq terms. | Privacy · Terms |
| Sarvam AI (Sarvam Systems Pvt Ltd) | India | Tamil-optimised language model — engaged only when a Vendor sets Tamil as their locale in AI Agent settings; used for reply drafting and intent parsing on Tamil conversations | Customer message content on Tamil-locale conversations across the Meta Channels the Vendor has enabled. No-training data position per Sarvam terms. | Privacy · Terms |
| Cloudflare, Inc. (R2) or Amazon Web Services, Inc. (S3) | United States (configurable) | Object storage for product images uploaded by Vendors | Product images (no PII unless the Vendor uploads images containing PII) | Cloudflare DPA · AWS terms |
Conditional sub-processors (per-Vendor opt-in)
The following providers are engaged only when a Vendor explicitly enables them in their Unisay settings. They are listed here for full transparency; a Vendor who has not enabled the corresponding integration has none of the below in their processing chain.
- Zep AI, Inc. (United States) — long-term conversation memory. Engaged only when the Vendor supplies a
ZEP_API_KEYin the AI settings. Processes summarised conversation state on behalf of that Vendor only. - Langfuse GmbH (Germany) — AI trace observability. Engaged only when the Vendor supplies Langfuse credentials in the AI settings. Processes AI request / response spans (which may contain Customer message content) for that Vendor’s own quality review.
Cross-border transfers
All sub-processors listed above except Neon’s Singapore region operate in the United States or the European Union / Ireland. The Sri Lanka Data Protection Authority has not yet designated any third country as having an adequate level of protection under PDPA s.26(2). Where personal data is transferred outside Sri Lanka, we rely on the instruments contemplated by the Authority’s draft Directive on Cross-Border Transfers (issued for public consultation 2 October 2024), namely (depending on the sub-processor):
- binding corporate rules within a sub-processor’s corporate group;
- contractual data-protection commitments in our Data Processing Agreement with the sub-processor;
- industry codes of conduct subscribed to by the sub-processor;
- binding certification schemes adhered to by the sub-processor; and
- cross-border processing impact assessments where required.
See Privacy Policy §8 for the corresponding Vendor- and Customer-facing disclosure.
Changes to this list
We will update this page when we add, remove, or replace a sub-processor. Material additions are notified in advance via the Unisay dashboard, with a 30-day objection window. Vendors who wish to be notified by email may subscribe via Settings → Notifications.
Questions
For questions about our sub-processors or to exercise your right to object, contact our Data Protection Officer at dpo@unisay.ai, or write to AnnFar Global (Pvt) Ltd (trading as Unisay), 22/4, Peterson Tower, Havelock City, Havelock Road, Colombo 05, Sri Lanka.