Sub-processors
Version subprocessors-v1.0-2026-10 · In effect from 9 October 2026
This list is checked against what our production systems actually connect to, not against plans. A vendor is on it from the moment a credential for it exists in our production environment.
Holla processes personal data for its customers (Tenants), and the vendors below process it on our behalf to deliver the Service. Each receives the minimum it needs. The commitments around this list, advance notice of changes and your right to object, are in section 5 of the Data Processing Agreement.
How changes work
We email Tenant owners at least 30 days before we engage a new sub-processor, and update this page at the same time. You can object to a new sub-processor on reasonable data-protection grounds, as the Data Processing Agreement sets out. Removals and changes of purpose are recorded in the change log below.
Current sub-processors
| Vendor | Purpose | Personal data it receives |
|---|---|---|
| Supabase | Database, sign-in, file storage, realtime and vector search | All service data |
| Railway | Application servers and message queues. Every message in and out passes through | Message and lead data in transit and in queues |
| Cloudflare | Storage for media your customers send; hosting for the dashboard | Voice notes, images and documents from end customers |
| Anthropic | Language-model inference for the assistant | Message content, qualification facts, listing and knowledge context |
| Meta (WhatsApp Cloud API) | WhatsApp message transport and account connection | End-customer phone numbers, messages, delivery receipts and media |
| Speechmatics | Voice-note transcription (default) | Voice audio |
| Deepgram | Voice-note transcription (fallback, and default for English-only accounts), on its EU endpoint | Voice audio |
| Cohere | Text embeddings for listing and knowledge search | Listing and knowledge text, which can carry broker names and contact details |
| Calendar connection when a broker connects one; address lookup and maps; Google Sheets when a Tenant connects it | Broker calendar events and sign-in tokens; listing addresses; browser IP address and map position | |
| Resend | Email: invitations, alerts and digests, and the portal lead emails a Tenant forwards to Holla | Broker and owner names and email addresses, lead summaries; in forwarded lead emails, end-customer names, phone numbers and enquiries |
| Firecrawl | Reading your public portal pages during onboarding to import listings and your team | Broker names, BRNs, phone numbers and photos as published on those pages |
| PostHog | Product analytics for signup, in its EU region (Frankfurt) | Account and workspace identifiers and the setup steps reached. No messages, names, emails, phone numbers or BRNs |
| Sentry | Error monitoring, with personal-data scrubbing on | Identifiers that appear incidentally in error reports |
| Vercel | Hosting for holla.ae and these legal pages, and our DNS | Visitors' IP addresses and the pages they request |
Two transcription vendors are listed because both are live. Each account’s voice notes go to one of them, with the other as fallback.
Meta and Google also act as independent controllers for part of their processing, under their own terms: Meta for WhatsApp transport, Google for calendar data.
Related services that are not sub-processors
- Stripe processes payments for paying Tenants. Billing data is Holla’s own, as a controller, and is described in the Privacy Notice. Stripe never receives end-customer conversation data.
- Cal.com runs the “book a call” window on holla.ae. No Holla system sends it data; a visitor who books gives Cal.com their details directly.
- Browser push services (Apple, Google or Mozilla, depending on the browser) carry the alerts a broker turns on. Each alert is encrypted to the broker’s device, so the service carries it without being able to read it.
Corrections we have made
Earlier versions of our public documents named Twilio and Doppler. We have never engaged either. We corrected the record when we checked this list against our systems, and we keep it checked the same way.
Change log
- 9 October 2026. First publication of this page.
- 10 October 2026. Removed the waitlist and contact-form wording from Vercel’s entry. holla.ae has neither any more.
Contact
Questions about this list: privacy@holla.ae.