Sub-processors
Version: 1.2 | Updated: October 14, 2026
This page lists third parties ("sub-processors") that Wharm uses to deliver the Service. Depending on configuration, some data may be processed outside Malaysia.
Core Sub-processors
Meta Platforms
WhatsApp Business Platform / Cloud API
- Purpose: Send/receive WhatsApp messages, deliver templates, handle media and messaging events
- Data categories: WhatsApp identifiers (phone numbers), message content, timestamps, metadata, media references
- Processing location: Global (Meta data centers). If Cloud API Local Storage is enabled, message data can be stored at rest in a selected region/country after processing.
Vercel
Hosting / Compute
- Purpose: Web app hosting, API execution
- Data categories: Account/session data, request metadata, application data processed by the API
- Processing location: Singapore (project configuration). Note: edge/network behavior may involve processing near end users unless regions are pinned.
Supabase
Database / Auth / Storage
- Purpose: Authentication, Postgres database, file storage, backend functions
- Data categories: Customer admin accounts, workspace configuration, contact records, conversation records (if stored), knowledge base content, attachments (if stored)
- Processing location: Asia Pacific (Singapore)
OpenAI
AI Processing
- Purpose: AI-assisted drafting, summarization, classification, embeddings (if enabled)
- Data categories: Message content or excerpts, knowledge base snippets, prompts/config, and related metadata
- Processing location: United States (API). Default retention for abuse monitoring logs is up to 30 days unless configured otherwise (e.g., Zero Data Retention).
Oracle Cloud
Backups / Development
- Purpose: Daily backups of core tables, kept for 14 days, and the development server
- Data categories: Contact records, conversation records, workspace configuration
- Processing location: Malaysia (Johor)
Razorpay Curlec
Payments
- Engaged by: Each business, under its own merchant account and agreement with Razorpay Curlec. Wharm passes the details below to the checkout on the business's instruction; payments are made to the business, not to Wharm.
- Purpose: Taking payment when a customer books through Bookings & Payments
- Data categories: Name, email and phone number, pre-filled at checkout, and the payment details the customer enters
- Processing location: Malaysia
Development Tooling
(Not Intended for Production Personal Data)
GitHub / Codespaces
- Purpose: Source code hosting, development environments, CI/CD
- Data categories: No production personal data intended. Production data should not be stored in repos, issues, or CI logs.
- Processing location: Varies by GitHub/Azure configuration.
Changes
- 14 October 2026 — Razorpay Curlec entry clarified. It is engaged by each business under that business's own merchant account, not by Wharm.
- 13 October 2026 — Oracle Cloud and Razorpay Curlec listed. Both were already in use; this page had not named them.
- 15 September 2026 — Telegram removed. Internal operational alerts, which previously included message previews, contact names and phone numbers, are no longer sent to Telegram. They are kept within Wharm and delivered to Provider staff devices as encrypted push notifications that contain no customer message content.
Related Documents
Contact
Questions about sub-processors: