Sub-processors and other providers
Frostrek LLP runs Frosty Agent with help from the providers below. Each one receives only what it needs for the job shown. This is the list section 12 of our Privacy Policy refers to.
| Provider | What they do | Where they process |
|---|---|---|
| Supabase | Database, authentication, file storage | India (Mumbai) |
| Amazon Web Services | Servers that run Frosty Agent: everything passing through the application, and application logs | India (Mumbai) |
| Cloudflare | Network in front of our website, dashboards, API and chat widget (routing and attack protection); it carries every request, including IP address and message content | Global; may process outside India |
| AI models (Vertex AI and Gemini Live) and text-to-speech; Google Calendar connection; Gmail, when a merchant connects it and for some of our own emails | May process outside India | |
| Google (our website) | On frostyagent.com: Google Analytics and Google Tag Manager, only with your consent; fonts on staff screens and the invoice view; the booking calendar on our contact page | No region set; may process outside India |
| Meta | WhatsApp message delivery, and advertising measurement / Conversions API (when enabled by merchant) | No region set; may process outside India |
| Meta Pixel | Measures our own adverts on frostyagent.com, only with your marketing consent | No region set; may process outside India |
| Microsoft Clarity | Records how frostyagent.com pages are used (clicks, scrolls), only with your marketing consent | No region set; may process outside India |
| Twilio | Sends verification codes by SMS to phone numbers outside India: the phone number and the code. Not in use yet; used only once SMS verification is switched on | No region set; may process outside India |
| Airtel IQ | Sends verification codes by SMS to Indian (+91) phone numbers: the phone number and the code. Not in use yet; used only once SMS verification is switched on | No region set; may process outside India |
| Razorpay | Payment processing | No region set; may process outside India |
| Resend | Email delivery | No region set; may process outside India |
| Upstash | Caching and rate limiting | India (Mumbai) |
| Image hosts (Unsplash, Pravatar, UI Avatars, Wikimedia, Google profile photos) | Pictures shown on our pages; they receive your IP address and browser details | No region set; may process outside India |
| Postal-code lookups (India Post, OpenStreetMap Nominatim, Zippopotam.us) | Fill in the city from a postal code during sign-up; they receive only the postal code and country | No region set; may process outside India |
| Slack | Alerts to Frostrek's own staff about a merchant account, such as a billing or payment problem. The alert text can contain personal data: plan and billing details, payment references, and in some alerts a partly hidden email address. Used only when staff alerts to Slack are switched on | No region set; may process outside India |
Frostrek’s own AI relay. Some AI requests pass through a key-management relay that Frostrek runs itself. It is part of our own service, not a separate provider, and passes each request to Google (above). It currently keeps a shortened copy of each request and reply, with no expiry date. We are removing this.
Deepgram, Groq, ElevenLabs and Microsoft edge text-to-speech appear in our code but receive no personal data: the application refuses to start if any of them is switched on. Before we use one, it will be added to this list first, with the notice that section 12.1a of our Privacy Policy describes.