Velqia
Sub-processors
Version: 31 October 2026
Velqia GbR acts as processor for the data that end users leave in the assistant of business customers, and as controller of the data of its own customers. To provide the service it relies on the providers in this list.
| Provider | Purpose | Data | Location | Transfer mechanism | DPA status |
|---|---|---|---|---|---|
| Supabase | Platform database and authentication. | User accounts, assistant configuration, conversations, bookings and the data of the assistant’s end users. | EU — Stockholm (eu-north-1). Supabase lets the customer choose the project region, with EU options in Ireland, London, Paris, Frankfurt, Zurich and Stockholm. | According to the DPA Supabase publishes, the processor is Supabase Pte. Ltd. (Singapore) and the declared mechanism is the standard contractual clauses (Decision (EU) 2021/914, modules 2 and 3) and the UK addendum; the DPA does not mention the Data Privacy Framework and states that Supabase may process data wherever it or its sub-processors have facilities. Velqia’s contract is with Supabase Pte. Ltd., the entity designated in the DPA, and Velqia has not granted Supabase support staff access to the project data. | Supabase incorporates its DPA into its terms of service (version published dated 1 August 2026). The DPA is part of those terms and applies to all organizations; no separate signature is required. |
| Vercel Inc. | Hosting and execution of the web application; website performance measurement (Vercel Speed Insights, only with your consent). | Technical connection data (IP, browser, date and time, pages visited) and the traffic handled by the application’s functions. With Speed Insights (only with your consent), Vercel states that it records anonymous data points (route, URL, network speed, browser, device type, operating system and country) that do not allow a user to be identified or a session to be reconstructed. Runtime logs are kept for 30 days on Velqia’s plan. | By default, Vercel runs functions in Washington, D.C. (iad1) and lets the customer choose other regions, including Frankfurt, Stockholm, Paris, Dublin and London. The functions of Velqia’s project run in Frankfurt (fra1). | Vercel Inc. (Delaware, USA) states in its privacy notice that it complies with the EU-U.S. Data Privacy Framework (and the Swiss-U.S. one); its DPA also incorporates standard contractual clauses (Decision (EU) 2021/914) and the UK addendum. | Vercel incorporates its DPA into the agreement (updated 17 March 2026) and applies it to the Pro and Enterprise plans. Velqia is on the Pro plan, to which the DPA applies. |
| Anthropic, PBC | Artificial-intelligence model that generates the assistant’s replies. | End-user messages and business context sent to the API; with the Velqia Reviews add-on, the reviewer name, rating and text of each review. Anthropic states that it deletes API inputs and outputs within 30 days of receipt or generation (with exceptions, for example for usage-policy violations or legal requirements) and that, by default, it does not use them to train its models. | USA. The public documentation consulted does not state a processing region that the customer can choose. | According to Anthropic’s commercial terms, the contracting entity is Anthropic Ireland, Limited if the customer resides in the EEA, Switzerland or the UK (and Anthropic, PBC elsewhere). Its DPA declares standard contractual clauses (modules 2 and 3, Irish law) and the UK addendum; it does not mention the Data Privacy Framework. The only invoice on Velqia’s account (May 2026) was issued by Anthropic, PBC, so we do not state that the contract is with the Irish entity; data may be processed in the United States under the standard contractual clauses in Anthropic’s DPA. | Anthropic incorporates its DPA by reference into its commercial terms (in force since 24 February 2025). Velqia’s account is a business organization in the name of Velqia GbR; no separate acceptance of the DPA is on record. |
| OpenAI | Transcription of voice notes received through the messaging channels, and image generation for Velqia Social, only when those features are active. | Audio of the voice notes and the transcribed text. According to OpenAI’s documentation, API abuse-monitoring logs are retained for up to 30 days by default, but for the audio transcription endpoint its table shows no retention (neither in those logs nor in application state); OpenAI states that it does not use API data to train its models unless the customer opts in. For Velqia Social images only the description text and the business sector are sent; for image generation, OpenAI states that it does not use the data to train its models, that it keeps abuse-monitoring logs for up to 30 days and that it does not store application state. | OpenAI offers data residency in Europe (EEA and Switzerland) to eligible customers, subject to OpenAI’s prior approval. Velqia does not use regional data residency; processing may take place outside the EEA. | According to its published DPA, for customers in the EEA and Switzerland the DPA is entered into with OpenAI Ireland Ltd. OpenAI states that transfers outside the EEA or Switzerland rest on agreements containing standard contractual clauses or on a European Commission adequacy decision (Art. 45 GDPR). The only invoice consulted on Velqia’s account (September 2026) was issued by OpenAI OpCo, LLC (USA); we therefore do not state that the contract is with the Irish entity. | OpenAI incorporates its DPA into its services agreement (version 010126): it is accepted by clicking “I agree”, accepting the order form or using the services. There is no record that Velqia has signed OpenAI’s DPA. |
| Google (Gemini API, imágenes de Velqia Social) | Image generation for Velqia Social posts, only when the business requests it. | The text describing the image (written by the business or suggested by the AI), the business sector and a few fixed style rules. No photos, logos or end-user data are sent. With the paid API, Google does not use this data to improve its products and logs it for a limited period, only to detect violations of its usage policy and to meet legal obligations. | Google may process the data transiently in any country where it has facilities; it is not possible to choose the region. | Google LLC states its adherence to the EU-U.S. Data Privacy Framework. | The Gemini API Additional Terms of Service for paid services incorporate the Data Processing Addendum for Products Where Google is a Data Processor. Velqia’s account has billing enabled (paid service); there is no record of a separate signature. |
| Resend (Plus Five Five, Inc.) | Sending of transactional emails and platform notices (for example booking confirmations and reviews awaiting approval). | Recipient email address and content of the notice. Resend states that it keeps email and log data for 30 days on the Free, Pro and Scale plans, deletes the remaining data within 90 days of account termination, and keeps backups for 7 days. Velqia uses the Free plan. | Resend states that it stores its customers’ data in the United States; the sending region chosen when adding a domain only determines where email is sent from, not where it is stored. Velqia’s emails are sent from the Ireland region (eu-west-1). | Plus Five Five, Inc. (USA) states in its DPA that it complies with the EU-U.S. Data Privacy Framework and its UK Extension, and that transfers from the EEA are made under standard contractual clauses, which according to Resend stand on their own and do not depend on the certification. The DPA names no EU entity. | Resend incorporates its DPA into its terms (updated 31 December 2025) and states that it pre-signs it and that it is fully executed on sign-up; the signed copy can be downloaded in Settings → Documents. Velqia’s account has it available under Settings → Documents. |
| Stripe, Inc. | Subscription payments and invoicing. | Data of Velqia’s customers: identification, billing and payment. According to its DPA, Stripe acts as Velqia’s processor for part of the processing and as its own controller for other purposes (for example fraud prevention and regulatory compliance). It does not receive the assistant’s content. | According to Stripe’s DPA, the user transfers data to Stripe, LLC in the United States. The public documentation consulted does not state the storage location. | In Stripe’s services agreement, the contracting entity for users in the EEA is Stripe Payments Europe, Limited, and for customers outside the Americas the DPA is with that entity. Stripe, LLC (USA) states that it complies with the EU-U.S. Data Privacy Framework (and the Swiss-U.S. one and the UK Extension), and its DPA defines the standard contractual clauses (modules 1, 2 and, where applicable, 3) for when a transfer mechanism is required. | Stripe incorporates its DPA by reference into its services agreement (updated 28 September 2026). Velqia’s account is a German account in the name of Velqia GbR; no separate signature of the DPA is on record, since it is incorporated by reference. |
| Upstash | Protection against abuse (request rate limiting) and Velqia’s internal monitoring panel. | IP addresses of visitors and the email of whoever cancels a contract, inside short-lived keys (1 to 60 minutes); data of the monitored websites (name, URL and check results). It does not store messages or conversations. | Upstash offers databases in AWS regions that include Ireland (eu-west-1) and Frankfurt (eu-central-1), as well as London and others, and in Google Cloud (Belgium). Velqia’s store is in Frankfurt (fra1). | Upstash, Inc. (Delaware, USA) states in its DPA that it will use the Data Privacy Framework to receive European data in the United States and that, if the Framework does not cover the transfer or is invalidated, the standard contractual clauses are incorporated by reference. The DPA names no EU entity. | Upstash incorporates its DPA into its Terms of Service (the published PDF shows no date). Velqia’s database was created through the Vercel integration; no separate acceptance is on record. |
| Sentry | Detection and diagnosis of application errors. | Technical error data (URL, browser, operating system and stack trace). We do not enable the sending of personal data by default, but an error report may contain technical identifiers. Browser reports are only sent if you have accepted the banner and go through our own domain (/monitoring); server errors are always logged. Sentry states that it keeps errors for 30 days (Developer plan) or 90 days (Team and Business plans). Velqia uses the Developer plan (30 days). Velqia’s organization has the option of not storing IP addresses enabled, so Sentry does not record the IP of new events (since 25 October 2026); earlier ones may keep it for up to 30 days. | Sentry offers storage in the US (Iowa) or the EU (Frankfurt), chosen when the organization is created and not changeable afterwards; some data (user accounts, organization settings, audit logs, DSN keys and project metadata) is always stored in the US. Velqia’s organization stores error events in the EU (Frankfurt). | Functional Software, Inc. d/b/a Sentry (USA) states in its DPA that it complies with the Data Privacy Framework for transfers from Europe to the United States (including the Swiss-U.S. one and the UK Extension) and that, if the Framework does not apply or is invalidated, standard contractual clauses (modules 2 and 3) apply. The DPA names no EU entity. | Sentry offers its DPA, which takes effect on the date it is electronically accepted (not automatically incorporated according to the page consulted). Velqia accepted it on 25 October 2026 (version 5.1.0). |
| Backblaze, Inc. (B2) | Encrypted backups. | Backups encrypted with age before upload, so Backblaze cannot read their content: copies of the Supabase database (including end-user data of the assistant), of Stripe (customers and invoices) and of the Vercel configuration. Retention: 30 daily and 12 monthly copies (365 days). | EU — Amsterdam (Backblaze’s “EU Central” region). Backblaze also offers US (West and East) and Canada (East) regions; the region is chosen when the account is created and cannot be changed afterwards. | Backblaze, Inc. (USA) states in its privacy policy (30 April 2026) that it has certified to the Department of Commerce its adherence to the EU-U.S. and Swiss-U.S. Data Privacy Framework Principles; its DPA also incorporates standard contractual clauses. The content is additionally encrypted with age before upload, so Backblaze cannot read it. The DPA names no EU entity. | Backblaze publishes a DPA that supplements its Terms of Service and binds its customers (last updated: 20 September 2022); customers are deemed to have also agreed to the standard contractual clauses. It is part of Backblaze’s terms, with no separate signature. |
| Meta (WhatsApp, Instagram, Facebook Messenger) | Messaging channels: receiving and sending messages and connecting accounts, and publishing of content on Pages and Instagram, only when the business customer connects the channel. | Messages, account and user identifiers on the channel, profile name, voice notes and attachments. | WhatsApp Ireland Limited is the contracting entity for businesses in the EEA in the WhatsApp Business Platform terms (effective 23 September 2026); Meta’s data processing terms name Meta Platforms Ireland Limited for the EU. The public documentation consulted does not state where the data is stored. | Meta Platforms, Inc. and its US subsidiaries state that they have certified their participation in the EU-U.S. and Swiss-U.S. Data Privacy Frameworks (notice effective 30 July 2024). The WhatsApp Business terms provide for a data transfer addendum where WhatsApp Ireland Limited is the contracting entity. For Instagram and Messenger, Meta’s data processing terms (23 August 2025) only apply where the product terms state that Meta processes the data as processor; those terms mention neither the standard contractual clauses nor the Data Privacy Framework by name. | WhatsApp publishes Business Data Processing Terms (22 August 2025) that apply where its business terms state that WhatsApp processes the data as processor (the business is the controller); Meta publishes Data Processing Terms (23 August 2025) for products whose terms so state. Which of them applies to each channel depends on the product terms the business accepts; the public documentation consulted does not allow us to state which ones govern for Velqia. |
| Google Ireland Limited / Google LLC (Google Analytics 4) | Measurement of the use of the Velqia website, only with your consent. It is not involved in the assistant’s data. | Pages visited, device and browser type, approximate location and cookie identifiers. Velqia keeps event data for 2 months and user data for 14 months. | The public documentation consulted does not state where Google Analytics data is stored. The entity (Google LLC in the US version of the Terms of Service) and the transfer mechanism (Data Privacy Framework and standard contractual clauses; see “Transfer”) are on record. | Google LLC and its US subsidiaries state that they have certified their adherence to the Data Privacy Framework Principles (EU-U.S., Swiss-U.S. and the UK Extension); Google also states that it may rely on standard contractual clauses for certain transfers of its analytics and advertising products. | Google’s data processing terms (Google Ads Data Processing Terms, version 8.0 of 30 May 2024) apply to Google Analytics; Google states that, for customers established in the EEA, they are already incorporated into their terms. The Google Analytics Terms of Service (US version of 15 May 2023) are entered into by Google LLC. The data processing terms of Velqia’s account were accepted on 13 May 2026. |
| Google LLC (Business Profile API) | Velqia Reviews add-on: reading reviews and posting replies from the Google account the customer connects. | See the section on Google Business Profile data in the Privacy Policy. | The public documentation consulted does not state where Business Profile API data is stored. The entity (Google LLC in the Google APIs Terms of Service) and the transfer mechanism (Data Privacy Framework; see “Transfer”) are on record. | Google LLC states its adherence to the Data Privacy Framework (EU-U.S., Swiss-U.S. and the UK Extension). The Google APIs Terms of Service are entered into with Google LLC unless the additional terms of a given API provide otherwise (last modified: 9 November 2021). | Velqia’s application is published in Google Cloud with its brand information verified by Google; no separately signed DPA is on record. |
| Gmail (Google LLC) y Outlook (Microsoft), solo si el negocio conecta su correo | Optional “Connect email” feature: reading the new messages of the mailbox the business customer connects and sending replies from its address. | Received messages (sender, subject, text and attachments), the authorised email address and the access tokens, which are stored encrypted. Velqia does not delete or label messages. The Gmail connection is pending verification by Google; until then users may see an unverified-app warning. | Imported messages are stored in Supabase (EU, Stockholm) like the rest of the conversations. The location of the source mailboxes is determined by the customer’s email provider (Google, Microsoft or the one behind its IMAP/SMTP connection), not by Velqia. | Google LLC states its adherence to the Data Privacy Framework (EU-U.S., Swiss-U.S. and the UK Extension). Microsoft Corporation states in its privacy statement (September 2026) that it complies with the EU-U.S. Data Privacy Framework and applies, among other safeguards, standard contractual clauses approved by the European Commission. In an IMAP/SMTP connection, messages travel between Velqia and the mail server chosen by the business itself. | The use of Gmail data is limited to what the privacy policy describes, in line with the Google API Services User Data Policy, including its Limited Use requirements. In the IMAP/SMTP connection, Velqia has no contract with the business’s email provider. Velqia accesses the Outlook mailbox with the business’s OAuth authorisation, through the Microsoft Graph API, and limits the use of that data to what this policy describes. There is no record of a separate data processing agreement signed with Microsoft for this connection. |
| Spaceship (registro de dominio y DNS de getvelqia.com) | Registration of the getvelqia.com domain and management of its DNS. | Contact details of the domain holder. | Spaceship states in its DPA that it may process the data in the United States; the public documentation consulted does not state the specific storage location. | Spaceship, Inc. (USA) states in its DPA that it applies the European Commission’s standard contractual clauses (module 2, Decision (EU) 2021/914, Belgian law) to transfers outside the EEA to countries without an adequacy decision, except where the transfer relies on another recognised standard, such as the necessity of providing the service or consent. The DPA text does not expressly name the EU-U.S. Data Privacy Framework. | Spaceship incorporates its DPA (last updated: 24 April 2024) into its general terms and applies it to the services covered, including domain registration and Spacemail. It is considered signed by accepting its terms when the service is purchased; there is no record of a separate signature. |
| Spacemail (correo de Velqia: support@ y admin@) | Velqia’s email service (support@ and admin@). | Messages and content of communications with customers and contacts. | Spaceship states in its DPA that it may process the data in the United States; the public documentation consulted does not state the specific storage location. | Spaceship, Inc. (USA) states in its DPA that it applies the European Commission’s standard contractual clauses (module 2, Decision (EU) 2021/914, Belgian law) to transfers outside the EEA to countries without an adequacy decision, except where the transfer relies on another recognised standard, such as the necessity of providing the service or consent. The DPA text does not expressly name the EU-U.S. Data Privacy Framework. | Spaceship incorporates its DPA (last updated: 24 April 2024) into its general terms and applies it to the services covered, including domain registration and Spacemail. It is considered signed by accepting its terms when the service is purchased; there is no record of a separate signature. |
We will notify customers by email at least 30 days in advance of any addition or replacement of a sub-processor, as provided in the data processing agreement.
Questions or a request for the data processing agreement: admin@getvelqia.com