Sub-processors and Service Providers
Last updated: 3 August 2026
This page has two separate lists, because Filova does not hold the same legal role towards every provider. The first list covers sub-processors that access end-user data we process on your behalf. The second covers providers we use for our own operations (billing, account notifications, bot protection), where Filova is the controller. The distinction matters: the sub-processor authorisation and change-notification mechanism in the Data Processing Agreement (DPA) applies to the first list only.
1. Sub-processors — processing on your behalf
The providers below access personal data belonging to your WhatsApp end users while delivering the Wava service. They are sub-processors within the meaning of DPA §7: before making any material change to this list we notify existing Tenants by email at least 30 days in advance, and you have the right to object.
| Company | Purpose | Data Category | Location |
|---|---|---|---|
| WhatsApp Ireland Limited (Meta) | WhatsApp message delivery | Phone number, message content | Ireland (EU) — onward transfer to WhatsApp LLC (US) relies on the EU-US Data Privacy Framework |
| Anthropic, Inc. | AI-powered response generation | Message content, conversation history | United States |
| Supabase Pte. Ltd. | Database and authentication | All tenant and customer data | Singapore (contracting entity) — database hosting: EU (eu-central-1, Frankfurt) |
| Vercel Inc. | Application hosting | Request logs, IP address | United States (global CDN) |
| Sentry (Functional Software, Inc.) | Error tracking and application monitoring | Error and performance data (stack traces, request context) | United States |
| Upstash, Inc. | Idempotency (duplicate message-processing guard) | WhatsApp message ID — deleted after 24 hours | United States (contracting entity; provisioned through Vercel Marketplace) — data hosting: EU (AWS eu-central-1, Frankfurt) |
Note: some of these providers also serve Filova's own operations on the same infrastructure — Supabase and Vercel hold our account records, and Upstash is additionally used for dashboard/API rate limiting (visitor IP) and Paddle event deduplication. Each provider's role is shown here in respect of end-user data; they are not listed a second time.
2. Providers where Filova is the controller
The providers below do not access your end users' message data. What is processed here is the Tenant's own account/billing information, or signals from the person completing a form on our site; the decision to process is made by Filova, not by the Tenant. Accordingly, these are not sub-processors and they are not subject to the DPA's sub-processor authorisation or its 30-day change notification. These activities are described in our Privacy Policy.
| Company | Their role | Purpose | Data Category | Location |
|---|---|---|---|---|
| Paddle.com Market Limited | Independent controller (Merchant of Record) | Payment processing, invoicing and tax obligations | Tenant billing information and payment details | United Kingdom |
| Resend (Plus Five Five, Inc.) | Processor (acting on Filova's instructions) | Transactional email delivery — trial notifications | Tenant email address, business name | United States — choosing a sending region does not change this; account data and email logs remain in the US |
| Cloudflare, Inc. | Processor (acting on Filova's instructions) | Bot protection on the sign-up form (Turnstile) | IP address, TLS fingerprint and user-agent of the person completing the sign-up form | United States |
Paddle takes payment in its own name as Merchant of Record and is therefore an independent controller of billing data; its relationship with Filova is controller-to-controller. If Resend is later used to send messages to end users on a Tenant's behalf, it moves to the first list in respect of that use.
AI and model training
Message content is sent to Anthropic's API to generate replies, but it is not used to train models. Anthropic's Commercial Terms ("Customer Content" section, effective 17 June 2025) prohibit this explicitly: "Anthropic may not train models on Customer Content from Services." Anthropic conditions the only exceptions on explicitly submitting feedback or otherwise opting in; Wava does neither.
This is not merely a preference — it is a requirement of the WhatsApp Business Solution Terms: a business that retains an AI provider as its service provider may not allow data received through WhatsApp to be used to create, train, or improve any AI model. Wava does not train or fine-tune models on conversation data, and builds no shared model across tenants.
For questions, contact privacy@wavaapp.com.