To run okdoc we rely on a small set of third-party providers that process personal data on our behalf. The table below lists each active subprocessor, what it does for us, and the categories of data it receives. Some providers are engaged only when you enable a specific feature; those are marked. We do not sell personal information.
| Provider | Purpose | Data it receives | Region |
|---|---|---|---|
Supabase Privacy policy → | Primary database, file storage and authentication. | Account data, document files, recipient details, signatures, audit records. | EU (eu-central-2) |
Vercel Privacy policy → | Application hosting and server logs. | Request metadata, IP addresses, technical logs. | EU (fra1) |
OpenAI Privacy policy → | AI features: document generation, contract analysis, automatic field mapping on uploaded PDFs, recipient-triggered translation, and follow-up drafting. | The document content and prompts sent for these operations. OpenAI processes it under OpenAI's API terms. | United States |
Resend Privacy policy → | Transactional email delivery (signing invitations, reminders, notifications). | Recipient email addresses, sender details, message content. | United States |
Green API Privacy policy → | WhatsApp message delivery, when you enable it. | Signer phone numbers (including non-users), message content. | International |
Sumit (OfficeGuy) Privacy policy → | okdoc subscription billing, invoicing, and Sign&Pay card charging. | Billing details, transaction metadata, invoice data. Card data is tokenized in the browser; okdoc never receives full card numbers. | Israel |
Stripe Privacy policy → | Sign&Pay card charging, when your organization connects its own Stripe account. | Payment amount and transaction metadata. Card data is entered directly with Stripe; okdoc never receives full card numbers. | United States |
PayPal Privacy policy → | Sign&Pay payment collection, when your organization connects its own PayPal account. | Payment amount and transaction metadata. Payment credentials are handled directly by PayPal. | United States |
Google Analytics 4 Privacy policy → | Usage analytics on our marketing site and inside the signed-in app only. Not loaded on signer pages. | Pseudonymous usage events, device and browser data, IP-derived approximate location. | United States |
Microsoft Clarity Privacy policy → | Usage analytics on our marketing site and inside the signed-in app only. Not loaded on signer pages. | Pseudonymous interaction data, device and browser data. | United States |
Public URLs of published pages may also be submitted to search-indexing services (Google Indexing, IndexNow); these receive URLs only, never personal data. This list may change as the service evolves; we will update this page and note the change here.