Last updated: 10 August 2026
Sub-processors
These are the third parties that process personal data on our behalf so Reimbilly can work. We do not sell your data, and we do not share it for advertising. See the Privacy Policy for how we handle data generally.
Currently in use
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase Inc. | Primary database, authentication, file storage, backend functions | All account, expense, receipt, organisation and message data | India (ap-south-1) |
| Vercel Inc. | Hosting for the website and web application | IP address, request metadata | Global edge / USA |
| Functional Software, Inc. (Sentry) | Crash and error reporting | Stack traces, request ids, device and OS context, user id | USA |
| PostHog Inc. | Product analytics — which features are used, where people get stuck | Pseudonymous user id, in-app events, device type | European Union |
| ActiveCampaign, LLC (Postmark) | Transactional email — approvals, invitations, security alerts | Name, email address, message content | USA |
| Sendinblue SAS (Brevo) | Marketing email, only where you have opted in | Name, email address | European Union |
| Paddle.com Market Ltd | Merchant of record for subscriptions — billing, tax, invoicing | Name, email, billing country, payment method metadata | United Kingdom / EU |
| Razorpay Software Pvt. Ltd. | Payment collection in India | Payment amount, order and customer references, payment status | India |
| Intuit Inc. (QuickBooks Online) | Accounting sync — only if your workspace connects QuickBooks | Approved expense lines: vendor, amount, currency, date, description, category | USA |
| Xero Limited | Accounting sync — only if your workspace connects Xero | Approved expense lines: vendor, amount, currency, date, description, category | New Zealand / Australia |
| Google LLC / Microsoft Corporation | Single sign-on, only if you choose to sign in that way | Email address, basic profile from your chosen provider | USA / EU |
| Expo (650 Industries, Inc.), Apple APNs, Google FCM | Mobile builds, over-the-air updates, push notifications | Device push token, app version | USA |
| Cloudflare, Inc. | Bot protection on sign-in (Turnstile) | IP address, browser challenge signals | Global edge |
| OCR.space (a9t9 software GmbH) | Text extraction from uploaded receipts | The receipt image itself — merchant, amounts, dates, and anything else printed on it. Sent as a short-lived signed link that the provider fetches. | European Union |
| komoot GmbH (Photon) | Place search and reverse geocoding for mileage claims | Search terms and coordinates you enter when adding a mileage trip | European Union |
Not yet enabled
Listed for transparency. These handle reimbursement payouts and phone verification, which are built but switched off — no data has been sent to them. This page is updated before any of them is turned on.
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| RazorpayX | Reimbursement payouts to employee bank accounts / UPI | Beneficiary name, UPI VPA or masked bank details, payout amount | India |
| Cashfree Payments | Alternative payment and payout rail | Payment and beneficiary references | India |
| SMS / OTP gateway | Phone verification one-time passcodes | Phone number, one-time passcode | India |
Changes and questions
We update this page when a sub-processor is added, removed, or changes what it receives. To ask about a specific processor, or to raise a concern, write to privacy@reimbilly.com.
Grievance Officer: Sachin Zore — grievance@reimbilly.com