Last updated: 8 October 2026
Sub-processors
These are the third parties that process personal data on our behalf so Reimbilly can work. We do not sell your data, and we do not share it for advertising. See the Privacy Policy for how we handle data generally.
Currently in use
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase Inc. | Primary database, authentication, file storage, backend functions | All account, expense, receipt, organisation and message data | India (ap-south-1) |
| Vercel Inc. | Hosting for the website and web application | IP address, request metadata | Global edge / USA |
| Upstash, Inc. | Rate limiting for backend functions | User id or IP address inside rate-limit counters, which expire within an hour | India (ap-south-1) |
| Functional Software, Inc. (Sentry) | Crash and error reporting | Stack traces, request ids, device and OS context, user id | USA |
| PostHog Inc. | Product analytics — which features are used, where people get stuck | App: pseudonymous user id, in-app events, device type (only after you opt in). Website: page address, referrer, browser type, IP address (no cookies) | European Union |
| ActiveCampaign, LLC (Postmark) | Transactional email — approvals, invitations, security alerts. Also receives bank transaction alerts you choose to forward to your Reimbilly alert address. | Name, email address, message content. For forwarded bank alerts we store only the transaction we extract — amount, merchant, date and the last four digits of the card — never the message itself. | USA |
| Sendinblue SAS (Brevo) | Marketing email, only where you have opted in | Name, email address | European Union |
| Paddle.com Market Ltd | Merchant of record for subscriptions — billing, tax, invoicing | Name, email, billing country, payment method metadata | United Kingdom / EU |
| Razorpay Software Pvt. Ltd. | Payment collection in India (no new payments since 7 October 2026; keeps the records of earlier payments) | Payment amount, order and customer references, payment status | India |
| Intuit Inc. (QuickBooks Online) | Accounting sync — only if your workspace connects QuickBooks | Approved expense lines: vendor, amount, currency, date, description, category | USA |
| Xero Limited | Accounting sync — only if your workspace connects Xero | Approved expense lines: vendor, amount, currency, date, description, category | New Zealand / Australia |
| Google LLC / Microsoft Corporation | Single sign-on, only if you choose to sign in that way | Email address, basic profile from your chosen provider | USA / EU |
| Expo (650 Industries, Inc.), Apple APNs, Google FCM | Mobile builds, over-the-air updates, push notifications | Device push token, app version | USA |
| Cloudflare, Inc. | Bot protection on sign-in (Turnstile) | IP address, browser challenge signals | Global edge |
| OCR.space (a9t9 software GmbH) | Text extraction from uploaded receipts | The receipt image itself — merchant, amounts, dates, and anything else printed on it. Sent as a short-lived signed link that the provider fetches. | European Union |
| Project OSRM public routing server (router.project-osrm.org) | Driving distance for mileage claims | Start, stop and end points of the trip you are calculating, sent from our server. Your IP address is not shared | Not published by the operator |
| komoot GmbH (Photon) | Place search and reverse geocoding for mileage claims | Search terms you type, and map positions rounded to about 100 m, sent from our server. Your IP address and exact location are not shared | European Union |
Not yet enabled
Listed for transparency. This handles phone verification, which is built but switched off — no data has been sent to it. This page is updated before it is turned on.
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| SMS / OTP gateway | Phone verification one-time passcodes | Phone number, one-time passcode | India |
Reimbilly does not pay anyone and holds no money. If your company connects its own RazorpayX or Cashfree Payouts account to pay claims through it, that provider is your company's processor under your company's own agreement with it, not ours: we send the payout instruction (employee name, UPI ID or bank account, amount) to your account, on your instruction.
Changes and questions
We update this page when a sub-processor is added, removed, or changes what it receives. To ask about a specific processor, or to raise a concern, write to privacy@reimbilly.com.
Grievance Officer: Sachin Zore — grievance@reimbilly.com