Service Providers & Sub-processors

About Sub-processors: To provide our Parlario WhatsApp/Instagram/Telegram CRM and AI Agent services (parlario.co), Bridgeware Technologies engages third-party sub-processors to assist in data hosting, messaging delivery, artificial intelligence processing, and security infrastructure. This page details the current sub-processors and service providers engaged by Bridgeware Technologies. Telegram is listed for transparency only: it is a channel the customer manages directly with Telegram, not a sub-processor appointed by Bridgeware Technologies (see DPA section 5.4).

1. Overview

Bridgeware Technologies (“we”, “us”, or “our”) uses third-party Service Providers and Sub-processors to perform various functions necessary for operating the Parlario platform. A “Sub-processor” is a third-party data processor engaged by Bridgeware Technologies who receives, processes, or has access to Customer Personal Data in connection with providing the Parlario service.

All Sub-processors are subjected to rigorous security reviews and contractually bound by data protection obligations that meet or exceed applicable privacy standards, including the Australian Privacy Principles (APPs), EU/UK General Data Protection Regulation (GDPR), and applicable cross-border transfer requirements.

Parlario's runtime footprint is intentionally minimal: outside of the WhatsApp Cloud API and the Instagram messaging API (both Meta), the optional Telegram Bot API (the bot is the Customer's own), an optional single AI model gateway, Stripe for billing, the Google Calendar API, the Shopify Admin API and the WooCommerce REST API of the Customer's own store (all three optional, Business and Advanced plans; WooCommerce runs on the Customer's own website, so it adds no company to this list), and our application hosting/database providers, no other external service touches Customer Data during normal operation — no object storage, no mandatory email delivery service, and no advertising or analytics trackers.

2. Active Sub-processors for Parlario

The following list details the third-party Sub-processors currently engaged by Bridgeware Technologies to support the provision of the Parlario service:

Service & Purpose: WhatsApp Business Platform API and Instagram messaging API (Instagram API with Facebook Login), Embedded Signup (WhatsApp) and Facebook Login for Business (Instagram) — two separate Meta apps, each with its own credentials — Graph API messaging routing and delivery, and — only if the Customer connects Meta Conversions API in Settings → Meta Ads (optional, available for “Click to WhatsApp” and “Click to Instagram” ads) — purchase event reporting to the Customer's own Ads Manager.
Data Processed: WhatsApp phone numbers or Instagram identifiers and usernames, message content, delivery status, media attachments, WhatsApp template interactions (Instagram has no template mechanism), and ad campaign attribution data (originating ad identifier and headline, click identifier ctwa_clid, from “Click to WhatsApp” or “Click to Instagram” ads). If the Customer connects Meta Conversions API, a contact identifier (the phone number, hashed, never in plain text, for WhatsApp contacts; the Instagram account ID for Instagram contacts) and the ctwa_clid are additionally sent to Meta when reporting a purchase.
Location & Transfer Mechanism: United States / Global
Standard Contractual Clauses (SCCs) / Data Privacy Framework

Service & Purpose: Telegram Bot API (api.telegram.org), only when the Customer's Owner turns Telegram on in Settings → Integrations and connects a bot in Settings → Channels → Telegram. The bot is the Customer's own: the Customer creates it with Telegram's @BotFather and pastes its token into Parlario; Bridgeware Technologies has no Telegram bot or instance-level Telegram credential of its own. Used to receive the messages customers send to the Customer's bot (through a webhook authenticated with a per-bot secret URL segment and Telegram's secret-token header) and to send the replies of the Customer's team or AI Agent. Private 1:1 chats only — no groups, channels, broadcasts, payments or Mini Apps — and a bot can never write first. The Customer accepts Telegram's Bot Platform terms directly with Telegram and is responsible for complying with them. Telegram messages are not reported to Meta Conversions API.
Data Processed: Telegram numeric user ID, @username (if any), first and last name as shown on Telegram, the text of messages and of the replies sent, and the bot token (used to call the Bot API; stored encrypted at rest and never shown in full). Photos, voice notes and files are not downloaded: only a short text placeholder and the caption are stored. Telegram provides no phone number and no delivery or read receipts to bots. When the AI Agent is on, the message text is sent to the AI provider as described in the AI cards below.
Location & Transfer Mechanism: United Arab Emirates / Global
Customer's own relationship with Telegram (Bot Platform terms); see the DPA, section 8.3

Service & Purpose: Optional large language model (LLM) gateway that powers the AI Agent's replies and the Laboratorio self-evaluation sandbox, only when a Customer enables the AI Agent for their organization. By default, requests are routed through the shared account Bridgeware Technologies pays for and manages; if the Customer chooses OpenRouter as the provider for their own key (Settings → AI), requests are routed through the Customer's own account instead (the Customer may instead choose OpenAI or Google Gemini as their key provider — see the cards below). OpenRouter may in turn route a given request to a downstream model provider (e.g. Anthropic, OpenAI, Google, or others) depending on the model selected; Bridgeware Technologies does not contract directly with those downstream model providers, and does not select which one handles a given request beyond the model configured through OpenRouter.
Data Processed: Conversation content relevant to generating a reply (message text, knowledge base context) — only when the AI Agent or Laboratorio is actively used; never sent otherwise.
Location & Transfer Mechanism: United States / Global
Standard Contractual Clauses (SCCs)

Service & Purpose: Only when the Customer chooses OpenAI as their own key provider in Settings → AI; Bridgeware Technologies does not send data to OpenAI by default or through the platform's shared key.
Data Processed: Conversation content relevant to generating a reply (message text, knowledge base context) — only when the Customer uses their own OpenAI key.
Location & Transfer Mechanism: United States / Global
Standard Contractual Clauses (SCCs)

Service & Purpose: Only when the Customer chooses Google Gemini as their own key provider in Settings → AI; Bridgeware Technologies does not send data to Google by default or through the platform's shared key.
Data Processed: Conversation content relevant to generating a reply (message text, knowledge base context) — only when the Customer uses their own Google Gemini key.
Location & Transfer Mechanism: United States / Global
Standard Contractual Clauses (SCCs)

Service & Purpose: Only when the Customer's Owner connects the business's Google Calendar in Settings → Extensions → Integrations (Business and Advanced plans), via the organization's own OAuth connection, with access limited to the “calendar.events” scope — never to any other information in the connected Google account. Used to create appointment events and check availability when the Customer's team or AI Agent books an appointment from a WhatsApp or Instagram conversation.
Data Processed: Appointment date and time, and the contact's name (used as the title of the created event) — only when the organization has connected this integration and an appointment is booked. Never conversation content or any other data from the Customer's Google account.
Location & Transfer Mechanism: United States / Global
Standard Contractual Clauses (SCCs)

Service & Purpose: Only when the Customer's Owner connects the business's own Shopify store in Settings → Extensions → Integrations (Business and Advanced plans), through a private app the Customer creates in its own Shopify account, limited to four read-only scopes (read_orders, read_fulfillments, read_products, read_customers). Used to turn events in the Customer's store — paid orders and shipments — into WhatsApp messages to the customer who placed the order, and to show that customer's recent orders inside the Inbox. Those events reach Parlario through two webhooks the Customer creates in its own store admin, signed with the store's own key and verified by Parlario on arrival. Where the Customer has also connected Meta Conversions API, the total and currency of a paid order are reported to the Customer's own Meta ad account so its Ads Manager can calculate return on its campaigns. Bridgeware Technologies holds no write access of any kind: it never creates, modifies or cancels orders and never touches inventory.
Data Processed: Data flows from the Customer's store to Parlario, not the other way around. Read: order contents, amounts and currency, fulfilment and shipping status, product names, and the name and phone number of the store's customers. Email addresses and postal addresses are deliberately not requested. No Customer Personal Data is sent to Shopify by Parlario.
Location & Transfer Mechanism: Canada / United States / Global
Standard Contractual Clauses (SCCs)

Service & Purpose: Managed PostgreSQL database hosting and user authentication/session storage for the Parlario platform.
Data Processed: Account credentials (hashed passwords), CRM contacts, sales pipeline stage data, conversation history, encrypted connection tokens.
Location & Transfer Mechanism: United States / Global (Supabase infrastructure)
Standard Contractual Clauses (SCCs)

Service & Purpose: Web application hosting and compute for the Parlario platform (AWS Amplify Hosting or Google Cloud Run, depending on the deployment). Serves the application and handles incoming HTTPS requests; does not perform separate object storage or CDN functions beyond what the hosting platform provides by default.
Data Processed: IP addresses, HTTP request headers, application logs, encrypted deployment configuration.
Location & Transfer Mechanism: United States / Australia / Global regions
Standard Contractual Clauses (SCCs) / ISO 27001 (AWS) or Google Cloud equivalent

Service & Purpose: Payment gateway, billing processing, subscription management, invoice issuance.
Data Processed: Billing contact details, subscription tier IDs, payment transaction metadata (PCI-DSS compliant).
Location & Transfer Mechanism: United States / Global
Standard Contractual Clauses (SCCs) / PCI-DSS Level 1

Service & Purpose: Sends three specific emails, only when the instance operator has configured this provider: the email confirmation sent at registration, the recovery link when a user requests “Forgot your password?”, and the confirmation of an email address change on the account. Without this configuration, none of the three features are available.
Data Processed: The user's email address and a single-use confirmation or recovery link that expires in 1 hour. Never conversation content, WhatsApp credentials, or payment data.
Location & Transfer Mechanism: United States / Global
Standard Contractual Clauses (SCCs)

Service & Purpose: Backup provider for the same three emails Postmark handles (above) — configured and ready to be reactivated, but not processing live traffic while Postmark is the instance's active provider.
Data Processed: The same as Postmark, if it were ever reactivated: the user's email address and a single-use confirmation or recovery link that expires in 1 hour. Never conversation content, WhatsApp credentials, or payment data.
Location & Transfer Mechanism: United States / Global
Standard Contractual Clauses (SCCs) / ISO 27001

Limited, optional use of email. Outside of the emails described above (only if the operator configured an email provider), Parlario doesn't send any other kind of automated email. Team account credentials are never emailed: when an organization owner creates a teammate's account or resets their password, the temporary password is shown once on screen for the owner to share directly.

3. Corporate Affiliates

Depending on the geographic location of the subscriber, Customer Personal Data may also be accessed or processed by corporate affiliates of Bridgeware Technologies, including:

Bridgeware Technologies Pty Ltd (Australia) — Primary operating entity providing service development, administration, and technical support.

4. Customer-Managed Integrations (Bring Your Own AI Key)

From Settings → AI within Parlario, an organization's owner may optionally connect their own API key from OpenRouter, OpenAI, or Google Gemini, in place of the shared key Bridgeware Technologies provides by default. When a Customer configures their own key:

The Customer directly contracts with their chosen AI provider under that provider's own terms and pricing — Bridgeware Technologies is not a party to that relationship and does not bear its cost.
The relevant content of the Customer's conversations is transmitted to the Customer's own account with that provider (instead of Bridgeware Technologies' shared account) to generate the AI Agent's replies and Laboratorio evaluations.
The key itself is encrypted at rest (AES-256-GCM) using the same method Parlario uses for WhatsApp connection tokens; only its last 4 characters are ever shown in the interface.
The Customer may remove their key at any time to revert to Bridgeware Technologies' shared key.

5. Sub-processor Updates & Notification Process

Bridgeware Technologies maintains an up-to-date list of Sub-processors on this page. When we intend to engage a new Sub-processor or make material changes to existing Sub-processors, we will notify subscribers by updating this documentation and/or sending an email notification to registered account administrators at least 10 to 30 days prior to authorizing the new Sub-processor to process Customer Data.

Objections to New Sub-processors

If a customer objects to the appointment of a new Sub-processor on reasonable grounds relating to data protection or security, the customer must notify Bridgeware Technologies in writing within 10 business days of receiving notice. Upon receiving an objection, Bridgeware Technologies will work in good faith to propose an alternative solution or configuration. If no mutually agreeable solution is available, either party may terminate the affected service in accordance with our Data Processing Addendum.

6. Inquiries & Contact

If you have questions regarding our Service Providers, Sub-processors, or data security practices, please contact our legal and privacy team:

Email: privacy@parlario.co