Sub-processors
Last updated: 13 September 2026
Vorbly is operated by "MOYSHA CRM SOLUTIONS" S.R.L. To provide the service we rely on a small number of service providers. Each of them processes personal data only on our documented instructions, under a written agreement that imposes confidentiality and security obligations equivalent to our own.
This page is referenced from our Privacy Policy and from the Data Processing Addendum. It is the authoritative list.
Current sub-processors
| Provider | What they do for us | Where they process | Data they can access |
|---|---|---|---|
| Anthropic PBC | Generates the assistant's replies from the conversation and the business's knowledge base | United States | Conversation text and the business's configured knowledge, for the duration of the request. Retained by the provider for 30 days for safety and security purposes, then deleted. Not used to train models. |
| Supabase Inc. | Database, file storage and authentication | European Union (Ireland), with provider-side support and sub-processing in the United States and Singapore | All data stored by the service: conversations, contact details, files, account data |
| Vercel Inc. | Application hosting and content delivery | United States, with edge locations worldwide | Data in transit, request logs, IP addresses |
| Telegram Messenger Inc. | Delivering notifications to business owners and operating Telegram channels | International | Messages and identifiers exchanged through Telegram |
| Meta Platforms Ireland Ltd. | Operating Instagram, Messenger and WhatsApp channels, where a business connects them | Ireland and United States | Messages and identifiers exchanged through those platforms |
We do not use advertising networks, data brokers, or analytics providers that receive conversation content.
Changes to this list
We give account holders at least 30 days' notice before adding or replacing a sub-processor that handles visitor data. Notice is given through the notification channels configured in the dashboard.
An account holder may object on reasonable data protection grounds. If we cannot resolve the objection, they may terminate the affected service without penalty and receive a pro-rata refund of the unused prepaid period.
International transfers
Some of these providers process data in the United States, which is not recognised as providing an adequate level of protection. Those transfers take place under standard contractual clauses incorporated into our agreements with them. A copy of the relevant clauses, and Supabase's transfer impact assessment, are available on request.
Questions
Write to privacy@vorbly.ai.