Subprocessors and Third-Party Services Disclosure

This disclosure lists the key third-party service categories indicated by the current codebase and flags where the inventory is still incomplete.

Operated by Fortis Buildnext

Section 1

Known service categories from the current codebase

The current product indicates use of or support for the following third-party service categories: payment processing and payout services, mobile money and payment-link providers, AI inference providers for image extraction, analytics tooling, communications tooling for SMS or WhatsApp, browser push-notification services, and data infrastructure or storage services.

Payments and payouts: Paystack, MTN MoMo, Hubtel, and connected payment rails where configured.
AI providers: Anthropic Claude, OpenAI, and Google Gemini through failover-capable extraction workflows.
Analytics and event processing: PostHog on the client side where enabled, and Supabase-backed analytics sinks where configured.
Communications: WhatsApp Business tooling where configured, Hubtel SMS delivery, browser push-notification services, and SendPulse for transactional auth email delivery.

Section 2

Infrastructure gaps still to confirm

The codebase reviewed for this draft does not fully settle the final production host, object-storage vendor, CDN, or every vendor used for backup and support operations. [NEEDS ENGINEERING CONFIRMATION: production hosting, storage, CDN, and support tooling inventory.]

Section 3

Change management

Pawalink may change subprocessors or third-party services as the platform evolves. Material updates to this list should be reflected in the published legal set and internal vendor inventory before launch or as soon as reasonably practical after a change.

Related legal pages

AI Feature Disclosure

Explains photo extraction, draft generation, third-party AI processing, and merchant review duties.

Data Retention and Deletion

Retention periods, deletion limits, and data subject rights for accounts, orders, KYC, payments, logs, caches, and backups.

Security and Disclosure Policy

Plain-language responsible disclosure guide covering reporting, scope, timelines, and Ghana Cyber Security Authority escalation.