Subprocessors
What is a subprocessor?
A subprocessor is a third-party service that processes customer data on Flostac's behalf. We share the minimum data each service needs to do its job, and we review every subprocessor before adding it. This page lists every subprocessor currently in use.
If you want to subscribe to changes to this list, email team.flostac@gmail.com with the subject “Subprocessor change notifications” — we will email you at least 30 days before any new subprocessor receives customer data.
Current subprocessors
Supabase
Privacy policy ↗- Purpose
- Database, authentication, file storage, and row-level security.
- Data shared
- All workspace data: accounts, contacts, campaign records, action logs, uploaded media.
- Region
- AWS, primary region configurable per workspace (default: us-east-1).
Vercel
Privacy policy ↗- Purpose
- Application hosting, edge delivery, and serverless functions for the Flostac web app.
- Data shared
- Every request you make to app.flostac.in passes through Vercel (headers, cookies, request bodies — none are persisted by us beyond session handling).
- Region
- Global edge network.
Nylas
Privacy policy ↗- Purpose
- Email integration — connecting your mailbox so Flostac can sync threads and send mail on your behalf.
- Data shared
- OAuth tokens, email headers, message bodies, and contact metadata for the mailbox you connect.
- Region
- United States (Nylas-hosted infrastructure).
Meta (Facebook, Instagram, WhatsApp)
Privacy policy ↗- Purpose
- Ad management, lead retrieval, and messaging when you connect a Facebook Business account or WhatsApp Business number.
- Data shared
- Long-lived access tokens, ad account IDs, page IDs, lead form fields, message content, and webhook events for the assets you authorize.
- Region
- Per Meta platform policy.
- Purpose
- OAuth login, Google Sheets import, Google Ads management, and YouTube data when connected.
- Data shared
- OAuth tokens, profile email/name, sheet contents you choose to import, Ads account metrics.
- Region
- Per Google API Services User Data Policy.
Vendors that do not receive customer data
For completeness, Flostac also uses the following services that receive no customer data from workspaces:
- Domain registrar (Namecheap) — registers flostac.in and related domains
- Email provider (Gmail / Google Workspace) — handles inbound and outbound email from the team.flostac@gmail.com address; no automated access to customer data