Subprocessors
Subprocessors
Last updated: October 2026
Who handles merchant and customer data for ChatFirm
These are the third parties that process data on ChatFirm's behalf in order to run the service. They are authorised under our Data Processing Addendum, and each is bound to protect the data. Your courier (currently Leopards Courier) is the merchant's own provider and is not listed here.
| Subprocessor | What it does | Data it handles | Location |
|---|---|---|---|
| Shopify Inc. | Platform on which ChatFirm is installed. Delivers order and checkout events to ChatFirm and receives the changes ChatFirm makes (for example order tags and notes). | Store details; orders and checkouts of the Merchant's own store. | Canada / United States (Shopify's infrastructure) |
| Supabase Inc. | Database and file storage for ChatFirm: merchant settings, orders, abandoned checkouts, privacy-request records, logs and payment screenshots. Data is encrypted at rest and in transit. | All data described in the Privacy Policy, except message content held only inside WhatsApp. | Sydney, Australia (AWS ap-southeast-2) |
| Groq, Inc. | AI language model that judges whether a customer's free-text address reply is a complete delivery address. | The text of the customer's address reply only. No name, phone number or order number is sent. Groq does not train on it and, with ChatFirm's zero-data-retention setting, does not keep it. | United States |
| Railway Corp. | Hosts the shared OpenWA service, an open-source, unofficial WhatsApp Web integration through which messages are sent and received on the Merchant's own WhatsApp account. | WhatsApp session credentials needed to stay connected, and a copy of the messages the session sends and receives (including customers' replies), which the service deletes automatically after 30 days. | As configured for ChatFirm's Railway project (confirmed in the subprocessor register before launch) |
| Vercel Inc. | Hosts the ChatFirm web application and receives the order and checkout events sent by Shopify. | Customer name, phone number, address and order details while they are processed; request logs are kept for a short period. | United States (ChatFirm's functions run in Sydney, Australia) |
| ngrok Inc. | A tunnel that carries ChatFirm's internal requests to its workflow engine until the engine moves to its own server. | Order and customer details in transit, encrypted; ngrok does not store the content. | United States |
| Server hosting provider (ChatFirm application and workflow automation) | Runs the ChatFirm web application and the workflow engine (n8n) that carries out the automations. | Data in transit between Shopify, WhatsApp, the courier and the database; transient processing only. | Named here when production hosting goes live; this page is updated and merchants are notified before any new subprocessor handles customer data |
Changes to this list
We give merchants at least 30 days' notice, in the dashboard and by updating this page, before a new subprocessor starts handling customer data. A merchant who objects on data-protection grounds may uninstall the app within that period and its data will be erased. Questions: privacy@chatfirm.tech.