Sub-Processor List
Last Updated: May 2, 2026
QRCodeKey engages the third-party service providers listed below ("Sub-Processors") to help us operate the service. Each Sub-Processor receives only the personal data necessary to perform its function, is bound by a written Data Processing Agreement (DPA), and is contractually required to maintain at least the same level of data protection that we provide.
This page is published in support of our obligations under GDPR Article 28(2), the CCPA/CPRA service-provider regime, the India DPDP Act, 2023 Section 8(2), and most enterprise B2B Data Processing Agreements. We will provide reasonable advance notice via email or by updating this page before adding or replacing a Sub-Processor that processes personal data.
Active Sub-Processors
| Sub-Processor | Purpose | Data Processed | Location | Safeguards |
|---|---|---|---|---|
| AiSensy (Triny Innovations Pvt. Ltd.) | Alternative delivery route for WhatsApp scan alerts and WhatsApp OTP codes, used in place of the Meta Cloud API where configured | Phone number, message content (OTP codes, scan alerts including the scan location text), delivery metadata | India | Meta-approved WhatsApp Business Solution Provider; processes only on our instruction |
| Brevo (Sendinblue SAS) | Transactional emails — OTP / password reset / account notifications | Email address, name, message content (OTP codes, reset links, alerts) | European Union (France HQ, EU-only data centers) | DPA, GDPR-compliant, ISO 27001, SOC 2 Type II |
| Firebase Cloud Messaging (Google LLC) | Mobile and web push notifications | Device push token, notification payload | United States (global edge cache) | DPA, EU-US Data Privacy Framework |
| Google Maps Platform | Map display, geocoding, address autocomplete | IP, approximate location, search query | United States | DPA, EU-US Data Privacy Framework |
| Meta Platforms, Inc. (WhatsApp Business Cloud API) | WhatsApp delivery of scan alerts and one-time passcodes, for users who explicitly opt in to WhatsApp alerts | Phone number, message content (OTP codes, scan alerts including the scan location text), delivery metadata | United States and global WhatsApp infrastructure | DPA, EU-US Data Privacy Framework, Meta Business Terms |
| MongoDB Atlas | Encrypted cloud database — primary data store | All user data (encrypted at rest) | United States (AWS region) | DPA, ISO 27001, SOC 2 Type II, AES-256 encryption |
| MSG91 (Walkover Web Solutions Pvt. Ltd.) | Alternative delivery route for WhatsApp scan alerts and WhatsApp OTP codes, used in place of the Meta Cloud API where configured | Phone number, message content (OTP codes, scan alerts including the scan location text), delivery metadata | India | ISO 27001, Meta-approved WhatsApp Business Solution Provider; processes only on our instruction |
| OpenAI, L.L.C. | Powers the "AG" AI chatbot assistant | User chat messages and recent conversation context | United States | DPA, API data is not used to train OpenAI models, 30-day retention for abuse monitoring |
| OpenStreetMap Foundation (Nominatim) | Fallback geocoding — turning GPS coordinates into a street address when Google Maps returns no result, and powering address suggestions as you type | Latitude and longitude, and the address text being typed. Reverse geocoding of a scan is requested by our server, so only our server IP is seen. Address suggestions in the app are requested by your browser directly, so your own IP is seen by OpenStreetMap for those requests. | United Kingdom / European Union | Public service of a UK-registered non-profit. No name, email, phone number, account identifier, or QR code identifier is ever included in a query. |
| Render Services, Inc. | Backend hosting and infrastructure | Server logs, request data, session metadata | United States | DPA, SOC 2 Type II, encrypted volumes |
| Resend, Inc. | Transactional email delivery (primary email channel) | Email address, message content (OTP codes, reset links, account notifications) | United States | DPA, SOC 2 Type II, GDPR-compliant |
| Stripe, Inc. | Subscription billing and payment processing (USD) | Billing address, last 4 of card, transaction metadata. Full card details handled by Stripe — never stored by us. | United States | DPA, PCI-DSS Level 1, SOC 1 & 2 |
| Telnyx LLC | SMS / OTP delivery and account verification (US + international) | Phone number, OTP code, message content, delivery metadata | United States (HQ Chicago, IL) and global SMS routing | DPA, ISO 27001, SOC 2 Type II, HIPAA-aligned |
| Vercel Inc. | Frontend hosting and edge delivery | IP, user agent, request logs | United States and global edge network | DPA, SOC 2 Type II |
Planned Sub-Processors (not yet active)
The following sub-processors will be engaged when we launch the service in additional jurisdictions. They are not currently processing any personal data.
| Sub-Processor | Purpose | Location | Status |
|---|---|---|---|
| Razorpay Software Pvt. Ltd. | Payment processing in INR (planned for India launch) | India | Planned — activates with India launch |
| Fast2SMS | SMS / OTP delivery in India (planned) | India | Planned — activates with India launch |
Change Notification & Objection
For B2B / enterprise customers operating under a Data Processing Agreement, we will provide at least 14 days' advance notice via email or this page before engaging a new Sub-Processor that will process customer personal data. Customers may object to a new Sub-Processor on reasonable data-protection grounds; if we cannot resolve the objection, the customer may terminate the affected service component without penalty.
To subscribe to Sub-Processor change notifications, email info@qrcodekey.com with subject "Subscribe to Sub-Processor Updates".
Contact
Company: QRCodeKey by JAL Technology LLC
Address: 2501 Chatham Rd Suite N, Springfield, IL 62704, USA
Email: info@qrcodekey.com
Phone: (708) 690-0550