Subprocessors

The list

A subprocessor is any outside company that handles data on Manilla’s behalf. These are all of them, today — not a longer list of services we might integrate someday.

• Supabase — authentication, database, and file storage — the core of the product. Sees: account data, request/submission content, uploaded files. Location: United States (Oregon).
• Vercel — hosting for the application and API. Sees: everything that passes through a request to usemanilla.in. Location: Mumbai (compute region).
• Resend — delivers every transactional email — confirmations, reminders, receipts. Sees: recipient email address and the email's content. Location: United States.
• Razorpay — payment processing for INR subscriptions. Sees: billing details needed to charge a card, UPI ID, or bank account — Manilla never receives or stores these directly. Location: India.
• PayPal — payment processing for existing USD subscriptions. Sees: billing details PayPal collects at checkout, same as Razorpay — Manilla never sees the underlying payment method. Location: United States.
• Groq — reads your prompt (and, for a photo or scan, the image) to generate the AI request builder's suggested fields — the primary model behind that feature. Sees: the request title, field list, your instruction, and any image you attach to the AI panel. Location: United States.
• Google (Gemini API) — fallback for the AI request builder when Groq can't complete the request — used only then, today on Google's free tier, meaning Google may use what's sent to improve its own products; this changes once billing is enabled on that project. Sees: the same request title, field list, instruction, and any attached image as above. Location: United States.
• Sentry — error tracking, so a crash gets fixed instead of going unnoticed. Sees: stack traces and request context at the moment of an error — not gated by the analytics consent banner, see Privacy for why. Location: United States.
• PostHog — product analytics — whether signing up and sending a request actually works, end to end. Sees: usage events, off by default — only runs if you accept the consent banner. Location: United States.

Data processing agreements

Manilla is built and operated by one person — see About. There isn’t a lawyer-drafted DPA template ready to sign on request today. If your organization requires one before you can use Manilla, get in touch and we’ll work through what you need rather than pointing you at a document that doesn’t exist yet.

Related

See Privacy Policy for what we collect directly and why, and Security for how it’s protected.