Draft for review. This text was prepared for approval by the operator and a qualified lawyer before the public launch. Items marked To be confirmed are still open.
Service providers
Last updated: 12 October 2026
These are the companies that process personal data for Opes, on our instructions and under data-processing terms. This list is part of our privacy policy.
Always in use
| Provider | What it does | Data it receives | Where |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Everything in your account: profile, records, uploaded documents, session and security logs | Mumbai, India |
| Vercel | Hosting and serverless functions; scheduled jobs | Requests to the app (IP address, browser), data in transit while it is processed | Mumbai, India (function region) |
| Vercel Web Analytics | Counts page views to measure audience and improve the service (no cookies) | Page address, referrer, country, browser, operating system and device type, and a short-lived visitor identifier derived on Vercel's servers | Vercel infrastructure |
| Vercel Speed Insights | Measures page loading speed and responsiveness (no cookies) | Page address, performance timings, country, browser and device type | Vercel infrastructure |
| Cloudflare (Turnstile) | Bot check on sign-in, sign-up and password reset | Challenge token, IP address and browser signals | Global network |
| Resend | Sending emails the app sends itself (invitations, approvals, data-rights notices) | Recipient email address and the message content | Provider infrastructure (United States / EU) |
Used only when you use the feature
| Provider | What it does | Data it receives | Where |
|---|---|---|---|
| Groq (or another OpenAI-compatible provider) | Answers in the help chat | The messages you type in the chat and the help context sent with them. Do not type secrets or account numbers in the chat | United States |
| Amazon Web Services (Textract) | OCR for scanned bank-statement PDFs, only when you import a scanned file | The pages of that statement, for the time needed to read them | AWS region configured by the operator |
| GitHub | Receives bug reports you submit, as issues | The text of the report; do not include personal data | United States |
Public market and reference data (no personal data)
| Provider | What it does | Data it receives | Where |
|---|---|---|---|
| Finnhub, CoinGecko, Yahoo Finance, GoldAPI, Metals-API, open.er-api.com, WatchCharts | Prices, exchange rates and valuations | Only public identifiers (a ticker, a coin, a currency pair). No personal data or amounts are sent | Provider infrastructure |
| Favicon and logo services | Show a bank's or issuer's logo | The public domain name of the bank or issuer | Provider infrastructure |
Transfers outside the EU/EEA and the UAE
Several providers above operate outside the EU/EEA and the UAE. We rely on the EU Standard Contractual Clauses (and, where a provider is certified, the EU-US Data Privacy Framework) or an equivalent safeguard under the UAE PDPL. To be confirmed: Operator to sign or accept each provider's data-processing agreement and confirm the transfer mechanism for each row.
Not yet active
Direct bank connections through an open-finance provider are built but not connected to live banks. If they are switched on, the provider will be added here before any of your bank data is exchanged.
Changes to this list
We will announce a new provider that handles personal data in the app or by email before it starts. See the privacy policy.