Last updated: February 23, 2026
Ooty engages the following third-party sub-processors to provide the Service. Each sub-processor is bound by a data processing agreement imposing obligations no less protective than those set out in our Data Processing Agreement.
| Sub-Processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Vercel | Hosting and serverless compute | United States (with global edge network) | Website data, API request routing |
| Supabase | Database and authentication | European Union (London, AWS eu-west-2) | Account data, OAuth tokens, licence data |
| Upstash | Session management and rate limiting | United Kingdom (London, AWS eu-west-2) | Session metadata, rate limit counters |
| Paddle | Payment processing (Merchant of Record) | United Kingdom | Payment details, billing information, tax compliance |
| Resend | Transactional email | United States | Email addresses, email content |
We shall notify existing customers by email at least 30 days before adding any new sub-processor. You may object to the appointment of a new sub-processor by contacting within 30 days of notification. The objection procedure set out in Section 5 of our Data Processing Agreement shall apply.
Where a sub-processor is located outside the United Kingdom or the European Economic Area, appropriate safeguards are in place to ensure the protection of Personal Data. These safeguards include Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework. For further details, refer to the International Data Transfers section of our Privacy Policy.
For questions regarding our sub-processors: