In effect · 12 August 2026
To run WeYala we use a small number of providers, each doing one job. This page names them, says what they do, and says where they hold data. It supports the Privacy Policy and any data processing agreement we enter into.
| Provider | What it does | What it can see | Location | Their policies |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage, secrets | Account data and all stored content | United States (us-east-1) | Privacy · Security |
| Anthropic | AI models — planning, architecture, code, drafting, classification | The content sent to perform a given task | United States | Privacy · Terms |
| OpenAI | AI models — second-opinion review only, where an independent check is wanted | The specific artifact under review | United States | Privacy |
| Fly.io | Container compute — where the agents actually run | Content in transit during a task | United States (iad) | Privacy |
| Vercel | Web hosting for weyala.ai | Technical data — IP address, request logs | United States | Privacy |
| Sign-in. We receive your name, email and profile picture; we never see your password | Account identity | United States | Privacy | |
| Resend | Outbound email delivery | Message content and recipient addresses for outreach | United States | Privacy |
| ImprovMX | Inbound email forwarding for our own role addresses | Mail sent to weyala.ai addresses | France / EU | Privacy |
| Google Fonts | Serves the typefaces every page uses (fonts.googleapis.com, fonts.gstatic.com) |
IP address and browser, on every pageview — including before you sign in, and whether or not you ever do | United States | Privacy |
| esm.sh | Public CDN delivering the Supabase JavaScript client to your browser | IP address and browser, on pages that load it | Global CDN | Site |
| GitHub | Source-code hosting for the products we build, where you use that option | Generated code and repository metadata | United States | Privacy |
Listed so this page stays honest as the service grows. Nothing below currently receives any data.
| Provider | What it would do | When |
|---|---|---|
| Stripe | Payments. Card details would go to Stripe directly and we would never hold them | If and when billing is introduced |
| Grafana Labs | Operational metrics and traces — system health, not content | When observability is wired up |
We use the AI providers above under business/API terms that do not permit training on customer inputs or outputs. We do not opt in to any training or data-sharing program on your behalf. Providers may retain inputs briefly for abuse monitoring under their own terms.
Some providers above sit on infrastructure we do not contract with directly, and it would be misleading to imply the list stops where our invoices do.
Amazon Web Services. Supabase runs our database, authentication and file storage in AWS us-east-1 (Northern Virginia). Your data therefore physically resides on AWS hardware. Our agreement is with Supabase; theirs is with Amazon.
Content delivery. Google Fonts and esm.sh are public CDNs your browser contacts directly. We do not send them your content — but your browser reveals its IP address to them when it fetches a font or a script, which is a connection you did not choose and should know about.
We would rather not depend on either. Self-hosting the fonts and pinning the JavaScript client locally would remove both connections and the supply-chain exposure that comes with loading executable code from a third party. It is on the list to fix; until it is done, this page says so plainly rather than omitting them.
The Their policies column links to each provider's own privacy and security terms. Those govern what that provider does with data we send it, and they can change without us. They are listed so you can check them yourself rather than take our summary on trust.
Where a provider offers a data processing agreement, we intend to hold one. We will say here when each is in place rather than imply it now.
We will update this page before a new sub-processor starts handling customer content, and we will give notice where a data processing agreement requires it. If you have a DPA with us and object to a new sub-processor, tell us and we will work out an alternative or let you terminate without penalty.
Questions: founder@weyala.ai.