Review-ready draft. A qualified lawyer must approve it before use; items in [brackets] are decisions or facts for counsel to confirm. This text is not legal advice.
Subprocessors
Origin Pixel Solutions, Chennai, Tamil Nadu, India · Version 2026-11-03 · Last updated 3 November 2026
Every company Origin Pixel uses, or can use, to run the Origin Platform and that may process client personal data, with what it does, where, the transfer safeguard and its data processing agreement. We announce new or replacement sub-processors here and by email at least 30 days before they start.
Get change emails
Clients' main logins are emailed automatically. Anyone else can subscribe:
We send a confirmation link first and use your address only for these notices. Every email has an unsubscribe link.
Announced and recent changes
- New: Apple Inc. (Apple Messages for Business) and an Apple-approved MSP — announced 2026-11-12, effective 2026-12-12. Messages to and from Apple Messages for Business (not available yet)
- New: Off-site backup storage [provider to be named] — announced 2026-11-12, effective 2026-12-12. Second copy of the encrypted database backups
Clients can object on reasonable data protection grounds before a change takes effect, under Legal agreements in the app or by writing to hariprathish@originpixel.in. See section 5 of the Data processing agreement.
Hosting, database and network
| Company | What it does | Data | Where and safeguard | When used |
|---|---|---|---|---|
| Supabase, Inc.DPA | Database, file storage, sign-in (authentication) and sign-in emails | All client data held in the platform | India (AWS Mumbai, ap-south-1). Company in the United States.Data stored in India; vendor support access from the US under EU SCCs (2021/914) and UK Addendum in the vendor DPA | AlwaysOrigin Pixel account |
| Hostinger International Ltd.DPA [confirm link] | Virtual server that runs the application, background jobs, the voice gateway and encrypted backups | Data passing through the application; encrypted backup files | India [confirm data centre]. Company in Cyprus [confirm contracting entity].Server in India; EU-established vendor | AlwaysOrigin Pixel account |
| Cloudflare, Inc.DPA | DNS for originpixel.in and the Turnstile bot check on sign-up (traffic is not proxied) | No client content; DNS lookups, IP address and browser signals for the bot check | Global network. Company in the United States.EU SCCs (2021/914) and UK Addendum in the vendor DPA; EU-US Data Privacy Framework | Always (DNS); bot check when TURNSTILE keys are setOrigin Pixel account |
AI models
| Company | What it does | Data | Where and safeguard | When used |
|---|---|---|---|---|
| Anthropic, PBC (Claude API)DPA [DPA incorporated; confirm link] | AI answers, summaries, scoring, drafts, document reading, voice agent reasoning and the Claude connectorTraining: Commercial API inputs and outputs are not used to train models | Only the text or file needed for each AI task | United States (and other Anthropic regions)EU SCCs (2021/914) and UK Addendum in the vendor DPA | When the platform uses Claude (the default for paying clients)Origin Pixel account |
| Google LLC (Gemini API, Vertex AI, Cloud Speech, Cloud Translation, RCS Business Messaging)DPA | Alternative AI provider, Gemini Live voice, embeddings for knowledge search, image generation, speech-to-text, text-to-speech, translation, Google RCS messagesTraining: Paid Gemini API / Vertex AI only: not used to train models. The unpaid Gemini API tier is never used in production. | Only the text, audio or file needed for each task; RCS message content and phone numbers | United States and other Google regions; Mumbai (asia-south1) where configuredEU SCCs (2021/914) and UK Addendum in the vendor DPA; EU-US Data Privacy Framework | Only when a Google provider is configuredOrigin Pixel account |
| OpenAI, L.L.C.DPA | Optional AI provider: voice agent reasoning, realtime speech, speech-to-text, text-to-speech, embeddings, image generation, transcription of voice notesTraining: API data is not used to train models by default | Only the text, audio or file needed for each task | United StatesEU SCCs (2021/914) and UK Addendum in the vendor DPA; EU-US Data Privacy Framework | Only when an OpenAI provider is configuredOrigin Pixel account |
| Groq, Inc.DPA [confirm DPA link] | Optional low-latency model host for voice agent reasoning and transcriptionTraining: [Confirm: API data not used for training] | Conversation text and audio for each turn | United StatesEU SCCs (2021/914) and UK Addendum in the vendor DPA [confirm] | Only when VOICE_LLM_PROVIDER=groq or the Whisper endpoint points to GroqOrigin Pixel account |
| Cerebras Systems Inc.DPA [confirm DPA link] | Optional low-latency model host for voice agent reasoningTraining: [Confirm: API data not used for training] | Conversation text for each turn | United StatesEU SCCs (2021/914) and UK Addendum in the vendor DPA [confirm] | Only when VOICE_LLM_PROVIDER=cerebrasOrigin Pixel account |
| Mistral AI SASDPA | Optional model host for voice agent reasoningTraining: Paid API: training opt-out [confirm setting] | Conversation text for each turn | European Union (France)EU-established vendor | Only when VOICE_LLM_PROVIDER=mistralOrigin Pixel account |
| OpenRouter, Inc.DPA [confirm DPA] | Optional model router for voice agent reasoning (forwards to the chosen model host)Training: Only providers that do not train on prompts may be enabled in the OpenRouter account settings | Conversation text for each turn | United States, then the selected model hostEU SCCs (2021/914) and UK Addendum in the vendor DPA [confirm] | Only when VOICE_LLM_PROVIDER=openrouterOrigin Pixel account |
| Cohere Inc.DPA [confirm link] | Optional embeddings and re-ranking for knowledge searchTraining: [Confirm: API data not used for training] | Knowledge base text and search queries | Canada / United StatesEU SCCs (2021/914) and UK Addendum in the vendor DPA; Canada adequacy [confirm] | Only when EMBEDDING_PROVIDER or RERANK_PROVIDER is cohereOrigin Pixel account |
| Voyage AI (MongoDB, Inc.)DPA [confirm DPA link] | Optional embeddings and re-ranking for knowledge searchTraining: [Confirm: opt out of training in the Voyage dashboard] | Knowledge base text and search queries | United StatesEU SCCs (2021/914) and UK Addendum in the vendor DPA [confirm] | Only when EMBEDDING_PROVIDER or RERANK_PROVIDER is voyageOrigin Pixel account |
| Jina AI GmbH (Elastic)DPA [confirm DPA link] | Optional embeddings and re-ranking for knowledge searchTraining: [Confirm: API data not used for training] | Knowledge base text and search queries | Germany / United States [confirm]EU-established vendor [confirm] | Only when EMBEDDING_PROVIDER or RERANK_PROVIDER is jinaOrigin Pixel account |
Speech (speech-to-text, text-to-speech, translation)
| Company | What it does | Data | Where and safeguard | When used |
|---|---|---|---|---|
| Sarvam AI [confirm legal entity]DPA [confirm DPA link] | Speech-to-text, text-to-speech and translation for Indian languagesTraining: [Confirm: API data not used for training] | Call and voice-note audio, text to speak or translate | IndiaProcessed in India; no cross-border transfer for this service | Voice agents and translation set to Sarvam (default for Indian languages)Origin Pixel account |
| Deepgram, Inc.DPA [confirm link] | Speech-to-text and text-to-speech for voice agentsTraining: Requests carry mip_opt_out=true (excluded from model improvement) [WP-AI] | Call audio and text to speak | United StatesEU SCCs (2021/914) and UK Addendum in the vendor DPA [confirm] | Only when a voice agent uses DeepgramOrigin Pixel account |
| Eleven Labs Inc. (ElevenLabs)DPA | Text-to-speech voices and speech-to-textTraining: enable_logging=false where the plan allows (zero retention) [confirm plan] | Text to speak, call audio | United States / European UnionEU SCCs (2021/914) and UK Addendum in the vendor DPA | Only when a voice agent uses ElevenLabsOrigin Pixel account |
| Cartesia, Inc.DPA [confirm DPA link] | Low-latency text-to-speech for voice agentsTraining: [Confirm: API data not used for training] | Text to speak | United StatesEU SCCs (2021/914) and UK Addendum in the vendor DPA [confirm] | Only when a voice agent uses CartesiaOrigin Pixel account |
| AssemblyAI, Inc.DPA [confirm link] | Streaming speech-to-text for voice agentsTraining: [Confirm: opt out of model training] | Call audio | United States (EU region available)EU SCCs (2021/914) and UK Addendum in the vendor DPA | Only when a voice agent uses AssemblyAIOrigin Pixel account |
| Microsoft Corporation (Azure AI Speech, Azure Translator; Microsoft 365 when you connect it)DPA | Speech-to-text, text-to-speech and translation; your Outlook calendar, Outlook mail, Teams or Dynamics 365 when you connect themTraining: Azure AI services do not use customer data to train models | Call audio, text to speak or translate; calendar events, emails and CRM records you sync | Azure region configured (Central India available)Microsoft Products and Services DPA (SCCs, EU Data Boundary) | Only when an Azure provider is configured or you connect a Microsoft accountOrigin Pixel account or your own |
| Amazon Web Services, Inc.DPA | Amazon Polly text-to-speech and Amazon SNS SMSTraining: Polly does not store or train on text [confirm AI opt-out policy] | Text to speak; phone numbers and SMS text | Mumbai (ap-south-1) by defaultAWS GDPR DPA (SCCs) | Only when Polly or SNS is configuredOrigin Pixel account or your own |
Telephony
| Company | What it does | Data | Where and safeguard | When used |
|---|---|---|---|---|
| Vobiz [confirm legal entity]DPA [confirm DPA link] | Indian phone numbers, inbound and outbound calls, call audio streaming | Phone numbers, call audio, call metadata, recordings where enabled | IndiaProcessed in India; no cross-border transfer for this service | Voice numbers routed through VobizOrigin Pixel account or your own |
| Plivo Inc.DPA [confirm link] | Phone numbers, calls, call audio streaming and SMS | Phone numbers, call audio, call metadata, recordings where enabled, SMS text | United States; India points of presenceEU SCCs (2021/914) and UK Addendum in the vendor DPA | Voice numbers or SMS routed through PlivoOrigin Pixel account or your own |
| Exotel Techcom Pvt. Ltd.DPA [confirm DPA link] | Indian phone numbers, calls, call audio streaming and SMS | Phone numbers, call audio, call metadata, recordings where enabled, SMS text | India (Singapore region optional)Processed in India; no cross-border transfer for this service | Voice numbers or SMS routed through ExotelOrigin Pixel account or your own |
| Twilio Inc.DPA | International phone numbers, calls, call audio streaming and SMS | Phone numbers, call audio, call metadata, recordings where enabled, SMS text | United States (other regions available)Twilio DPA with Binding Corporate Rules and SCCs | Voice numbers or SMS routed through TwilioOrigin Pixel account or your own |
| Telnyx LLCDPA [confirm DPA link] | International phone numbers, calls and call audio streaming | Phone numbers, call audio, call metadata, recordings where enabled | United States (global points of presence)EU SCCs (2021/914) and UK Addendum in the vendor DPA [confirm] | Voice numbers routed through TelnyxOrigin Pixel account or your own |
| Knowlarity Communications Pvt. Ltd.DPA [confirm DPA link] | Indian cloud telephony numbers and calls | Phone numbers, call audio, call metadata | IndiaProcessed in India; no cross-border transfer for this service | Voice numbers routed through KnowlarityOrigin Pixel account or your own |
| Servetel Communications Pvt. Ltd.DPA [confirm DPA link] | Indian cloud telephony numbers and calls | Phone numbers, call audio, call metadata | IndiaProcessed in India; no cross-border transfer for this service | Voice numbers routed through ServetelOrigin Pixel account or your own |
| Ozonetel Communications Pvt. Ltd.DPA [confirm DPA link] | Indian cloud telephony numbers and calls | Phone numbers, call audio, call metadata | IndiaProcessed in India; no cross-border transfer for this service | Voice numbers routed through OzonetelOrigin Pixel account or your own |
SMS
| Company | What it does | Data | Where and safeguard | When used |
|---|---|---|---|---|
| MSG91 (Walkover Web Solutions Pvt. Ltd.)DPA [confirm DPA link] | SMS (DLT-registered) and verification codes in India | Phone numbers, SMS text, delivery status | IndiaProcessed in India; no cross-border transfer for this service | SMS routed through MSG91Origin Pixel account or your own |
| Gupshup [confirm contracting entity: Gupshup Technology India Pvt. Ltd. / Gupshup Inc.]DPA [confirm DPA link] | SMS in India and WhatsApp Business messages as a Meta Business Solution Provider | Phone numbers, message text and media, delivery status | India / United States [confirm][Confirm] | SMS or WhatsApp routed through GupshupOrigin Pixel account or your own |
| Kaleyra (Tata Communications) [confirm entity]DPA [confirm DPA link] | SMS in India and abroad | Phone numbers, SMS text, delivery status | India / European Union [confirm][Confirm] | SMS routed through KaleyraOrigin Pixel account or your own |
| Vonage (Nexmo; an Ericsson company)DPA [confirm DPA link] | International SMS | Phone numbers, SMS text, delivery status | United States / United KingdomEU SCCs (2021/914) and UK Addendum in the vendor DPA [confirm] | SMS routed through VonageOrigin Pixel account or your own |
| Textlocal [confirm current entity]DPA [confirm DPA link] | SMS in India | Phone numbers, SMS text, delivery status | IndiaProcessed in India; no cross-border transfer for this service | SMS routed through TextlocalOrigin Pixel account or your own |
| 2Factor.in [confirm legal entity]DPA [confirm DPA link] | Verification codes and SMS in India | Phone numbers, SMS text, delivery status | IndiaProcessed in India; no cross-border transfer for this service | SMS routed through 2FactorOrigin Pixel account or your own |
Email delivery
| Company | What it does | Data | Where and safeguard | When used |
|---|---|---|---|---|
| Resend (Plus Five Five, Inc.) [confirm entity]DPA | Sending emails (notices, follow-ups, digests) | Recipient address and name, email subject and body, delivery events | United StatesEU SCCs (2021/914) and UK Addendum in the vendor DPA | Mailboxes set to send through Resend (Origin Pixel's own notices, or your Resend account)Origin Pixel account or your own |
WhatsApp and messaging channels
| Company | What it does | Data | Where and safeguard | When used |
|---|---|---|---|---|
| Meta Platforms, Inc. / Meta Platforms Ireland Ltd. (WhatsApp Business Platform, Messenger, Instagram)DPA | WhatsApp Cloud API messages, Messenger and Instagram direct messages, Facebook and Instagram publishing | Phone numbers and profile names, message text and media, page and post content | United States and global Meta data centresWhatsApp Business Data Processing Terms and Meta Data Processing Terms (SCCs) | When a WhatsApp number, Facebook page or Instagram account is connectedOrigin Pixel account or your own |
| 360dialog GmbHDPA [confirm DPA link] | WhatsApp Business messages as a Meta Business Solution Provider | Phone numbers, message text and media, delivery status | Germany / European UnionEU-established vendor | WhatsApp connected through 360dialogOrigin Pixel account or your own |
| Interakt (Jio Haptik Technologies Ltd.) [confirm entity]DPA [confirm DPA link] | WhatsApp Business messages as a Meta Business Solution Provider | Phone numbers, message text and media, delivery status | IndiaProcessed in India; no cross-border transfer for this service | WhatsApp connected through InteraktOrigin Pixel account or your own |
| AiSensy [confirm legal entity]DPA [confirm DPA link] | WhatsApp template campaigns as a Meta Business Solution Provider | Phone numbers, template parameters, delivery status | IndiaProcessed in India; no cross-border transfer for this service | WhatsApp connected through AiSensyOrigin Pixel account or your own |
| Apple Inc. (Apple Messages for Business) and an Apple-approved MSPAnnounced for 2026-12-12 | Messages to and from Apple Messages for Business (not available yet) | Opaque Apple user id, message text and media | United States[To be confirmed when the MSP is chosen] | Not used yet; announced here before it is switched onOrigin Pixel account or your own |
Payments
| Company | What it does | Data | Where and safeguard | When used |
|---|---|---|---|---|
| Razorpay Software Pvt. Ltd.DPA [confirm DPA] | Origin Platform subscription billing; payment links and checkouts on your own Razorpay account | Payer name, email, phone, payment status (card data is entered on Razorpay, never on our pages) | India (RBI payment data storage rules)Processed in India; no cross-border transfer for this service | Billing in INR; payment links when you connect RazorpayOrigin Pixel account or your own |
| Stripe, Inc. / Stripe Payments Europe Ltd.DPA | Optional international card billing; payment links on your own Stripe account | Payer name, email, payment status (card data is entered on Stripe, never on our pages) | United States / European UnionEU SCCs (2021/914) and UK Addendum in the vendor DPA; EU-US Data Privacy Framework | Only when Stripe billing is switched on or you connect StripeOrigin Pixel account or your own |
Monitoring
| Company | What it does | Data | Where and safeguard | When used |
|---|---|---|---|---|
| Functional Software, Inc. (Sentry)DPA | Error reports from the application | Error messages and stack traces with personal data scrubbed; request ids | United States (EU region available)EU SCCs (2021/914) and UK Addendum in the vendor DPA | Only when SENTRY_DSN is setOrigin Pixel account |
| Grafana Labs (Raintank, Inc.)DPA [confirm link] | Metrics, traces and logs (OpenTelemetry / Loki) | Technical logs and traces; may include IP addresses and ids | Region chosen in Grafana Cloud (no India region)EU SCCs (2021/914) and UK Addendum in the vendor DPA [confirm] | Only when OTEL_EXPORTER_OTLP_ENDPOINT or the Vector Loki sink points to Grafana Cloud (CERT-In: prefer a self-hosted store in India)Origin Pixel account |
| Browser push services (Google Firebase Cloud Messaging, Mozilla Push Service, Apple Push Notification service) | Delivering app notifications to browsers and phones that opted in | End-to-end encrypted notification payload (RFC 8291) and a device endpoint; the service cannot read the content | United States / globalEncrypted payload; only delivery metadata is visible to the browser vendor | Only for people who switch on notificationsOrigin Pixel account |
Security checks
| Company | What it does | Data | Where and safeguard | When used |
|---|---|---|---|---|
| Intuition Machines, Inc. (hCaptcha)DPA [confirm link] | Bot check on sign-up (alternative to Cloudflare Turnstile) | IP address and browser signals | United StatesEU SCCs (2021/914) and UK Addendum in the vendor DPA [confirm] | Only when HCAPTCHA keys are setOrigin Pixel account |
Off-site backup
| Company | What it does | Data | Where and safeguard | When used |
|---|---|---|---|---|
| Off-site backup storage [provider to be named]Announced for 2026-12-12 | Second copy of the encrypted database backups | Backup files encrypted on our server before upload; the provider cannot read them | [India region to be confirmed]Encrypted before transfer | Only when BACKUP_RCLONE_REMOTE is setOrigin Pixel account |
Services you connect with your own account
These are used only when you connect your own account. They act for you under your agreement with them and are not Origin Pixel's sub-processors; data goes to them only after you connect them, and stops when you disconnect.
| Company | What it does | Data | Where and safeguard | When used |
|---|---|---|---|---|
| Telegram Messenger (Telegram FZ-LLC) | Messages to and from your Telegram bot | Telegram user id and name, message text and media | United Arab Emirates / globalYour own bot under Telegram's terms (no DPA offered) | When you connect your Telegram botOnly your own account |
| PayU Payments Pvt. Ltd. | Payment links on your own PayU account (Receivables, commerce) | Payer name, email, phone, amount and payment status (card data is entered on PayU, never on our pages) | India (RBI payment data storage rules)Processed in India; no cross-border transfer for this service | Only when you connect your PayU accountOnly your own account |
| Cashfree Payments India Pvt. Ltd. | Payment links on your own Cashfree account (Receivables, commerce) | Payer name, email, phone, amount and payment status (card data is entered on Cashfree, never on our pages) | India (RBI payment data storage rules)Processed in India; no cross-border transfer for this service | Only when you connect your Cashfree accountOnly your own account |
| Google LLC (Google Workspace, YouTube, Business Profile)DPA | Your Google Calendar, Contacts, Sheets, Drive imports, Gmail, YouTube channel and Business Profile | Calendar events, contacts, sheet rows, files you pick, emails, videos and reviews | Google global data centresYour own Google account terms | When you connect a Google accountOnly your own account |
| HubSpot, Inc.DPA | Two-way CRM sync | Contacts, companies, deals, activities | United States / EU (your HubSpot data centre)Your own HubSpot terms | When you connect HubSpotOnly your own account |
| Zoho Corporation Pvt. Ltd. (Zoho CRM, Zoho Books, Zoho Commerce)DPA [confirm link] | CRM sync, accounting sync, store orders | Contacts, leads, deals, invoices, orders | Your Zoho data centre (India: zoho.in)Your own Zoho terms | When you connect ZohoOnly your own account |
| Salesforce, Inc.DPA [confirm DPA link] | Two-way CRM sync | Leads, contacts, accounts, opportunities, activities | Your Salesforce instance regionYour own Salesforce terms | When you connect SalesforceOnly your own account |
| Pipedrive OÜDPA [confirm DPA link] | Two-way CRM sync | Persons, organisations, deals, activities | European Union / United StatesYour own Pipedrive terms | When you connect PipedriveOnly your own account |
| Freshworks Inc. (Freshsales)DPA [confirm link] | Two-way CRM sync | Contacts, accounts, deals | Your Freshworks data centre (India available)Your own Freshworks terms | When you connect FreshsalesOnly your own account |
| MarketXpander Services Pvt. Ltd. (LeadSquared)DPA [confirm DPA link] | Two-way CRM sync | Leads and activities | Your LeadSquared data centre (India available)Your own LeadSquared terms | When you connect LeadSquaredOnly your own account |
| Formagrid Inc. (Airtable)DPA [confirm link] | Sync to your Airtable bases | Rows you map | United StatesYour own Airtable terms | When you connect AirtableOnly your own account |
| Notion Labs, Inc.DPA [confirm link] | Knowledge import and database sync | Pages and database rows you share | United StatesYour own Notion terms | When you connect NotionOnly your own account |
| Slack Technologies, LLC (Salesforce)DPA [confirm DPA link] | Alerts and slash commands in your Slack | Alert text, names of leads or tickets | United States (data residency options)Your own Slack terms | When you connect SlackOnly your own account |
| Tally Solutions Pvt. Ltd. (TallyPrime) | Accounting export to your Tally | Vouchers, ledgers, parties | Your own computer or Tally server (India)Data goes to your own installation | When you use the Tally export or connectorOnly your own account |
| Shopify Inc.DPA | Orders, customers and abandoned checkouts from your store | Order and customer details | Canada / United StatesYour own Shopify terms | When you connect ShopifyOnly your own account |
| Your own store software (WooCommerce, Magento / Adobe Commerce, Dukaan, Instamojo, custom) | Orders, customers and checkouts from your store | Order and customer details | Wherever your store is hostedYour own hosting terms | When you connect your storeOnly your own account |
| LinkedIn Corporation / LinkedIn IrelandDPA | Publishing posts to your LinkedIn profile or page and reading post statistics | Post text and media, page statistics | United States / IrelandYour own LinkedIn terms | When you connect LinkedInOnly your own account |
| X Corp. (X / Twitter)DPA [confirm] | Publishing posts to your X account | Post text and media | United StatesYour own X terms | When you connect XOnly your own account |
| Your own SIP trunk or carrier | Calls over your own SIP trunk or PBX | Phone numbers, call audio, call metadata | Your carrierYour own carrier contract | When you connect a SIP trunkOnly your own account |
Questions
Write to hariprathish@originpixel.in. Items in [brackets] are being confirmed with the vendor or counsel.