These are the third parties that process data so Aivastark can run the Service, what each one receives, and when it is used.
Infrastructure
| Provider | Purpose | Data it receives | When |
|---|
| Supabase | Database, vector storage, authentication, file storage and server functions | All customer and end-user data. Hosted on AWS in Tokyo (ap-northeast-1). | Always |
| Vercel | Hosts the website, dashboard and widget script; relays widget and analytics requests; performance monitoring | Visitor IP addresses, browser details, page URLs | Always |
AI models
| Provider | Purpose | Data it receives | When |
|---|
| OpenRouter | Routes AI model requests: answers, image reading, embeddings, speech-to-text and knowledge processing | Conversation text and history, knowledge passages, tool results, images and audio customers send | Always |
| Model providers chosen by OpenRouter | Run the main answer model (currently DeepSeek V4.1 Flash), routed only to providers that don't collect prompts for training | The same as OpenRouter | Most answers |
| OpenAI | Fallback and image-reading models, embeddings and speech-to-text (through OpenRouter); read-aloud voice replies (direct) | Conversation text, knowledge passages, audio, reply text | Always |
| Anthropic | Knowledge-base processing (enriching pages, extracting FAQs) and inbox assist (drafts, summaries, translation), through OpenRouter | Page and document text, conversation threads | When you add knowledge or use inbox assist |
Content retrieval
| Provider | Purpose | Data it receives | When |
|---|
| Firecrawl | Crawls your website for the knowledge base; runs web searches and reads links visitors share, when those agent tools are on (on by default) | URLs, search queries written from visitor questions, links visitors paste | Always |
| Apify | Fallback website crawler | The start URL and crawl settings | When the main crawler can't read a site |
| Jina Reader | Last-resort page reader and PDF text extraction, including documents customers send on WhatsApp, Messenger or Instagram | A short-lived link to the page or file | Fallback only |
| thum.io | Screenshots your site for the shareable preview page | Your site URL | On request |
Location and widget assets
| Provider | Purpose | Data it receives | When |
|---|
| ip-api.com | Approximate location from IP for Visitor Lenz and location questions in chat | Visitor IP addresses | Always |
| ipapi.co, flagcdn.com, jsDelivr | Called from the visitor's browser by the widget: country lookup, flag images and a script library | Visitor IP address and browser details | Always |
Messaging and notifications
| Provider | Purpose | Data it receives | When |
|---|
| Resend | All email: invites, lead, handoff and ticket alerts, conversation transcripts and ticket mail | Email addresses, names, phone numbers, message excerpts and transcripts | Always |
| Twilio | WhatsApp alerts to your team | Team phone numbers; visitor name and contact details; a short summary | When WhatsApp alerts are on |
| Expo, with Apple and Google push services | Mobile app push notifications | Push tokens; notification text with a conversation preview | When the app's notifications are on |
| Browser push services | Dashboard push notifications | A push endpoint and an encrypted payload | When enabled |
Billing and monitoring
| Provider | Purpose | Data it receives | When |
|---|
| Stripe (and Shopify Billing for Shopify-app installs) | Subscription billing | Account and billing details | Paid plans |
| Sentry (US) | Error and performance monitoring for the app and server functions | Error messages, stack traces, page routes, user and organisation IDs (scrubbed; no session replay) | Always |
| Slack | Internal alerts to the Aivastark team about new sign-ups | Account email and name | Always |
Website analytics and advertising (aivastark.com)
| Provider | Purpose | Data it receives | When |
|---|
| Google Analytics 4 | Website analytics | Page views and browser details | Always |
| Meta Pixel | Advertising measurement | Page views and browser details | Always |
Integrations you connect
These services receive data only because you connect them to your account. You choose them, and your agreement with each one applies:
- Meta (WhatsApp, Messenger and Instagram) and Telegram
- Gmail or your own mailbox over IMAP/SMTP
- Shopify, WooCommerce, WordPress and your own Stripe account
- Google Calendar, Cal.com and Calendly
- HubSpot, Zendesk, Freshdesk and ClickUp
- Your Slack workspace, your webhooks, MCP servers and databases
Notifications & updates
We will notify customers of material changes to this list. Subscribe to updates by emailing support@aivastark.com with the subject "subscribe sub-processors."