LAST UPDATED: JULY 27, 2026
To run Ochito we rely on a short list of trusted vendors ("subprocessors"). Each one handles a specific part of the service. We choose vendors that hold independent security attestations (SOC 2 and similar), we sign data-processing agreements with them, and we share only the data each one needs to do its job. We do not sell your data, and we do not let any vendor use it for advertising.
| Provider | What it does for Ochito | Data it may process | Region |
|---|---|---|---|
| Supabase | Database, login, and file storage — the core system of record | Client business info, media, and the customer names/phone numbers used for bookings | United States |
| Railway | Application hosting and compute (the app itself) | Any data in transit while the app runs; standard server logs | United States |
| Netlify | Marketing-site hosting and application/contact form intake | What you type into a form: name, business, email, phone; server logs (IP, browser) | United States |
| Resend | Transactional email (owner sign-in codes, notifications) | Email address and the message content (e.g., a one-time code) | United States |
| Anthropic (Claude) | AI that drafts marketing from a business's own brand information | A business's own brand/marketing content. We do not send end-customer names or phone numbers. Anthropic does not train its models on API data. | United States |
| Plausible | Website analytics | Aggregate, cookieless usage only — no personal identifiers, no cross-site tracking | European Union |
If we add or replace a subprocessor that handles personal data, we update this page. Clients under a signed agreement can ask to be notified of material changes: +1 (305) 219-5798 · hello@ochitoai.com.