Zevis
by ZelixLabs
Subprocessors
Last updated 6 September 2026
These providers process personal data on behalf of Zelix Labs Pte Ltd (UEN 202619950K). Each is engaged under a written agreement requiring it to act only on our instructions and to place the same obligation on anyone it engages in turn.
Infrastructure
Supabase
Database, authentication and file storage.
Receives: All account and workspace data, uploaded documents and photographs, passwords, two-factor secrets and passkey credentials.
Vercel
Application hosting and scheduled jobs.
Receives: HTTP request data including IP addresses, and application logs.
AI
Anthropic
Drafting messages, writing knowledge pages, summarising enquiries and reading uploaded documents.
Receives: The data described under AI features in the privacy policy, including enquiry text, follow-up context and masked chat exports.
OpenAI
Image generation, and reading voice messages an owner sends their assistant.
Receives: Image prompts, an organisation's own reference photographs where it has uploaded them, and the audio of a voice message an owner sends to their assistant. The recording is read once and is not stored by us.
Messaging and email
Meta Platforms
WhatsApp message delivery, template review, and the WhatsApp Business Account an organisation connects.
Receives: Recipient phone numbers, message content and media.
respond.io
WhatsApp inbox and messaging, connected by the organisation.
Receives: Contact records and message content.
Resend
Email delivery, and provisioning of an organisation's sending domain.
Receives: Recipient email addresses and the full content of each email sent.
Payments
Airwallex
Subscription billing for Zelix AgentOS.
Receives: An organisation identifier, and card details entered directly into its own form. Card numbers never reach our servers.
HitPay
Payment collection by an organisation from its own customers.
Receives: The customer name, email address and amount for a checkout.
Systems an organisation connects
These run only when an organisation connects them, using a key it creates.
Cliniko
Practice management sync.
Receives: Nothing from us beyond the API key. Sends us patient names, contact details, dates of birth, appointments and recall records.
Plato Medical
Practice management sync.
Receives: Nothing from us beyond the API key. Sends us patient names, phone numbers, dates of birth and recall records.
Xero
Accounting.
Receives: Contact names, email addresses, phone numbers, invoices and payments.
Supporting services
Serper
Web search when researching a business for its knowledge base.
Receives: The business name and location. No customer data.
GIPHY
Finding an animated sticker when an assistant marks a milestone.
Receives: A search word chosen by us, such as confetti. No customer data, no organisation data and nothing an owner has written.
Make.com
Forwarding public enquiry submissions to an organisation's own automation, where it has configured one.
Receives: The whole enquiry, including name, phone number, email address and message.
Zelix support tracker
Our own internal support system at team.zelixlabs.com.
Receives: The reporter name and email address, the organisation, and the description written in the support form.
Google Fonts
A webfont referenced in our HTML emails.
Receives: Nothing from us. When a recipient's mail client renders the message, that recipient's IP address and user agent reach Google.
Where processing happens
Zelix AgentOS runs in Singapore and its database is hosted in Singapore. Several providers above operate from other countries, so personal data is transferred outside Singapore for the purposes stated.
Under the PDPA we stay responsible for that data and require comparable protection by contract. See the privacy policy for the full picture.
Changes to this list
We update this page when a provider is added or removed. The date at the top shows the last revision, and account owners are told about a new subprocessor before it starts processing their data.
An organisation that objects to a new subprocessor on reasonable data protection grounds should write to hello@zelixlabs.com before it starts processing. We will look for an alternative, and where there is none the organisation may end its subscription without penalty for the remainder of the paid term.
Not on this list. We call two weather services, data.gov.sg and MET Norway, using a business location rather than any personal data. Our emails contain Google Maps links, which send nothing until a recipient chooses to click one.
Zelix Labs · Singapore · Privacy Policy · Data Processing Terms · Terms of Service