Legal
Sub-processors
The service providers Haiya relies on, what each one does, what data it receives and where it processes that data.
Effective and last updated: 13 November 2026
The short version
Haiya runs on a small number of service providers. Each receives only what its job needs, under a written agreement. Services a business connects with its own account work under that business’s own agreement.
This summary is provided for convenience. The complete policy below governs.
1. Who else sees data
Haiya runs on a small number of service providers (“sub-processors”). Each one receives only what its job needs, under a written agreement, and the current list is always on this page. When a business connects its own account with an outside service (for example its own M-Pesa, Paystack or AI provider account), that service processes data under the business’s own agreement with it, not under Haiya’s.
2. Current sub-processors
These providers process data for Haiya today. Rows marked “only when the business connects its own account” are listed so you know where data goes; those services act under the business’s own contract.
| Sub-processor | What it does for Haiya | What it receives | Where | Notes |
|---|---|---|---|---|
| Contabo GmbH | Hosting: runs Haiya’s servers — the API, the database, the cache and the realtime service | Everything Haiya stores | Lauterbourg, France (EU); the company is German | — |
| Bunny.net (BunnyWay d.o.o.) | Object storage: stores files — message media, attachments and exports | The files themselves | Germany | — |
| Cloudflare, Inc. | Network and security: carries every request to Haiya’s website, web app and API, and checks forms for bots | Everything sent to or from Haiya on its way through | Cloudflare’s global network (a United States company) | — |
| Meta Platforms (WhatsApp Business Platform, Meta Business Agent) | Delivers WhatsApp messages; runs the AI agent a business turns on | The messages, media and templates a business sends and receives; the knowledge the business uploads for the agent | Meta’s regions (United States and others) | Meta bills the business directly for agent messages |
| Safaricom PLC (M-Pesa Daraja) | Payment requests to a customer’s phone | The customer’s phone number, the amount and a reference | Kenya | Only when the business connects its own M-Pesa account (the business’s own contract) |
| Paystack Payments Ltd, a Stripe company | Card and M-Pesa payments | The customer’s phone or email, the amount and a reference | Nigeria, on Stripe infrastructure | Only when the business connects its own Paystack account (the business’s own contract) |
| Pesapal Ltd | Haiya’s own subscription payments on the website (when offered) | The business owner’s name, email and the amount | Kenya | Haiya subscriptions only |
| Google LLC (Firebase Cloud Messaging) | Push notifications to Android phones and the web | A device token and the notification’s text | Google’s regions (United States and others) | — |
| Apple Inc. (Apple Push Notification service) | Push notifications to iPhones | A device token and the notification’s text | Apple’s regions (United States and others) | — |
| Sinch Mailgun (Mailgun Technologies, Inc.) | Transactional email: invites and sign-in codes | The recipient’s email address and the email’s text | United States | — |
| TypeSafe AI, Inc. (its Jev service) | Decides what a customer message is about, for automations a business built | The customer’s last message and up to four earlier ones, and the business’s own intent list; never names, phone numbers or identifiers | United States | Does not train on customer data; processor under its DPA (EU standard contractual clauses); its own sub-processors are at trust.typesafe.ai/subprocessors |
| Anthropic, PBC (Claude) | The same decision, when the first decision is unsure | The same text as above | United States | Does not train on API customer content; DPA incorporated in its Commercial Terms; its own sub-processors are at anthropic.com/subprocessors |
3. Bring-your-own AI provider (the Team assistant)
When a business connects its own AI provider account (Anthropic, OpenAI, or another OpenAI-compatible service) for the Team assistant, Haiya sends that provider the team’s question and the business’s own records the asking member may already see, under the business’s agreement with that provider. Haiya is not a party to that processing and does not name those providers here.
4. Changes to this list
We update this page before a new sub-processor processes Customer Personal Data; the date above shows the current version. Business customers may object to a new sub-processor as set out in section 7 of the Data Processing Addendum (haiya.co/legal/dpa).
5. Contact
Questions about this list may be sent to support@haiya.co or +254 722 925 311 (phone or WhatsApp). Haiya is owned and operated by Quest Website Developers Ltd, company number CPR/2014/172802, Muguku Business Center, 2nd Floor, Suite 2R, Posta Road, Kikuyu, Kiambu County 00902, Kenya.
Questions or requests
Email support@haiya.co or call or WhatsApp +254 722 925 311. Please do not send passwords, access tokens or unnecessary message content.