Data Processing & Sub-processors
Last updated: July 2026
1. Roles
For seller account data, AgatePro is the data fiduciary (DPDP Act) / controller. For buyer data that sellers process through AgatePro (inquiries, contacts, messages), the seller is the fiduciary and AgatePro acts as data processor on their instructions.
2. Sub-processors
We use the following sub-processors to operate the service. Each is bound by contractual data-protection obligations.
| Sub-processor | Purpose | Data categories | Location |
|---|---|---|---|
| Supabase | Database, authentication, storage | All account data, product catalogue, inquiries, buyer contacts, orders, message logs | AWS ap-southeast-1 (Singapore) |
| Vercel | Application hosting & edge network | Request metadata, server logs (transient) | Global edge; compute in ap-south-1 region where available |
| Anthropic | AI reply drafting (Claude) | Buyer inquiry text, seller catalogue excerpts (name, price, MOQ). Never payment data. | United States |
| Razorpay | Subscription billing & payments | Seller billing details, payment status. Card data never touches AgatePro servers. | India |
| Meta Platforms | WhatsApp Cloud API & Instagram messaging | Message content and identifiers for sellers using direct Meta integrations | Global (Meta infrastructure) |
3. Safeguards
- Per-seller API tokens encrypted at rest (AES-256-GCM).
- Row-level security isolates every seller's data.
- Raw webhook payloads archived after 90 days.
- Buyer erasure honored within 30 days of a deletion request.
4. Changes & contact
We update this page before onboarding a new sub-processor. Questions or DPA requests: privacy@mbglobalagate.com.