Legal
Sub-processors
Last updated 17 October 2026.
These are the sub-processors Pivra uses to run Pivra for business, the chatbot on your website. Our database, API, malware scanner, relay and sign-in email service operate in Sydney, Australia. Our website is delivered through Vercel’s global network. Some processing happens outside Australia, as listed below (for example, AI model processing in the United States). Providers may give their own staff support access from outside Australia under their terms. For how we protect data, and what we have not done yet, see the security page. For what we collect and why, see the privacy policy.
Sub-processors
| Sub-processor | What it does | When it is used | Where it holds data |
|---|---|---|---|
| Vercel | Delivers the website, dashboard and chat widget | Always | Global edge network |
| Fly.io | Runs the application, API and upload scanner | Always | Australia (Sydney) |
| Supabase | Database, sign-in and file storage | Always | Australia (Sydney) |
| OpenAI | Generates chatbot replies and the embeddings used to search your knowledge | Always | United States |
| Stripe | Payments. We never see or store full card numbers | Paid plans | Global |
| Amazon SES | Sends account and notification email, and the email channel | Depending on the features you use | Sydney region, as configured |
| Twilio or Meta | SMS handover alerts, sent through Twilio, and WhatsApp channels you connect through Twilio or Meta | Only if you turn them on | Global |
Supabase runs on Amazon Web Services in Sydney.
Integrations you connect, such as your CRM, calendar or job system, are not our sub-processors. They receive data on your instruction and are governed by that provider’s terms.
Measurement, advertising and analytics
These tools are not sub-processors of your chatbot data, and none of them runs in your chat widget. Google Analytics, Google Ads and Meta Pixel measure visits and ads on the pivra.ai website. PostHog is the product analytics for Pivra Desk. The last column says where and when each one runs.
| Tool | What it does | When it runs |
|---|---|---|
| Google Analytics | Measures visits on the pivra.ai website | On pivra.ai web pages, not in your chat widget. Its cookies stay off until a visitor consents |
| Google Ads | Measures ads and sign-ups on the pivra.ai website | On pivra.ai web pages, not in your chat widget. Its cookies stay off until a visitor consents |
| Meta Pixel | Measures ads on the pivra.ai website | On pivra.ai web pages, only where we have turned it on; not in your chat widget |
| PostHog | Product analytics for Pivra Desk, in its EU region (eu.i.posthog.com) | On pivra.ai/desk, counting page views without cookies until a visitor consents; in the Pivra Desk app only if you opt in |
Changes to this list
We’ll update this page before adding a new sub-processor that processes customer personal data.
We list a new or replacement sub-processor here at least 30 days before it starts processing customer personal data, except an emergency replacement needed for security or to keep the service running, which we list promptly.
Questions, or an objection to a change, go to support@pivra.ai .