Skip to content
Milvao
Trust centre

The providers that process data for Milvao

Last updated 5 November 2026

The short list of providers that host Milvao, send messages, write briefs and take payments, with the data each receives and where it processes it.

A sub-processor is a company that processes personal data on Milvao's behalf so we can provide the service. Communities that use Milvao decide how their members' data is used, and Milvao processes it for them (see the data processing agreement). The providers below process that data only for the purposes listed and under contract with us.

  1. 01Current sub-processors

    • Vercel
      What for:
      Hosting for the website and the app
      Data:
      Requests to the website and app (IP address, browser), app logs, and the data the app handles while it runs
      Where:
      Global network; app region not yet confirmed
    • Neon (PostgreSQL) or a managed MySQL provider
      What for:
      Database for community data and, separately, the logs
      Data:
      All workspace and member data; audit, security and AI call logs
      Where:
      Singapore
    • Meta (WhatsApp Cloud API)
      What for:
      Sends and receives WhatsApp messages on your community's business number
      Data:
      Message content and phone numbers in transit
      Where:
      Meta's own infrastructure, under Meta's terms
    • Anthropic (Claude)
      What for:
      Turns a request into a short brief
      Data:
      Redacted request text and your community's category and city names only
      Where:
      Outside India, including the United States
    • Cloudflare (Turnstile)
      What for:
      Stops bots on public forms and sign-in
      Data:
      Browser signals during form checks
      Where:
      Cloudflare's global network
    • SMTP email provider (Amazon SES in production, Mailtrap for testing)
      What for:
      Email to owners, operators and staff
      Data:
      Email addresses and email content (invites, password resets, notifications, billing mail)
      Where:
      Amazon SES: Mumbai, India (planned)
    • Stripe
      What for:
      Card payments in US dollars (only for: customers paying in US dollars, and members paying a community outside India where the community offers paid membership)
      Data:
      Billing contact, invoices and payment status. Card details stay with Stripe
      Where:
      United States and other countries
    • Razorpay
      What for:
      Payments in rupees (UPI, cards, net banking) (only for: customers paying in rupees, and members paying a community in India where the community offers paid membership)
      Data:
      Billing contact, invoices and payment status. Card and UPI details stay with Razorpay
      Where:
      India
    • Amazon Web Services (S3) or Vercel Blob
      What for:
      File storage
      Data:
      Blog images today; later, profile photos, community logos and data exports
      Where:
      AWS S3: Mumbai, India. Vercel Blob: not yet confirmed
    • cron-job.org
      What for:
      Runs Milvao's scheduled jobs and uptime checks
      Data:
      No personal data: it calls Milvao's job addresses on a schedule
      Where:
      Germany

    “Not yet confirmed” means we haven't fixed the provider's processing region for the production service. We will replace it here once we do.

  2. 02What stays with Milvao

    • Phone numbers are encrypted before they reach the database, and logs never contain full numbers, message text, passwords or tokens.
    • The AI provider receives only request text with phone numbers, emails and links removed, plus the community's category and city names. The member directory and profile answers are never sent.
    • Card and UPI details stay with Stripe and Razorpay. Milvao receives only the card brand and last 4 digits.
    • Milvao doesn't sell personal data or share it for advertising.

  3. 03How changes are announced

    Before a new sub-processor starts processing members' personal data, we add it to this page, change the date at the top, and email the owner of every community using Milvao. Owners who object can tell us at hello@milvao.com, and we will work with them on a solution, as set out in the data processing agreement.

    Removing a provider, or a change that doesn't affect personal data, is updated here without an email.

  4. 04Meta and WhatsApp

    Each community connects its own WhatsApp Business number to Milvao, in a WhatsApp Business Account the community owns. Meta processes messages under the WhatsApp Business terms the community accepts when it creates that account, and under Meta's own privacy policy. Milvao never joins, reads or posts in WhatsApp groups.