Sub-processors
This page is referenced by our Privacy Policy and our Business Account Terms & DPA.
What a sub-processor is
A third party we use to deliver part of the service, which processes personal data on our behalf — a cloud host, a courier, a payment processor.
Every one on this list is bound by a written data processing agreement requiring confidentiality, appropriate security, and processing only on our instructions.
We remain fully responsible to you for their performance.
Current sub-processors
We use sub-processors in the following categories. The named list of providers in each category, with their locations, is maintained as a current register and is available on request to any user or business customer at privacy@letshoraro.com. We publish the named list here as each contract is finalised.
| Category | Purpose | Data they process | Location |
|---|---|---|---|
| Cloud hosting | Hosting, storage, backups | All platform data, encrypted at rest | United Arab Emirates |
| Content delivery | Serving media and static content | IP addresses, request metadata | Regional |
| Payment processing | Card and wallet payments | Cardholder name, billing address, transaction data | International |
| SMS gateway | Verification codes and notifications | Mobile number, message content | Regional |
| WhatsApp Business provider | WhatsApp notifications | Mobile number, template content | International |
| Email delivery | Transactional email | Email address, message content | International |
| Push notification service | In-app notifications | Device token, notification content | International |
| Courier and logistics | Delivery of physical gifts | Recipient name, address, phone, parcel details | UAE and international |
| Manufacturing | Gift production and engraving | Engraving text, design files, order reference | United Arab Emirates |
| Quality assurance | Precious-metal authentication | Order reference, verification records | United Arab Emirates |
| Customer support platform | Support tickets | Contact details, ticket content | International |
| Error and performance monitoring | Crash diagnostics | Device information, error traces, IP address | International |
ℹ️ We do not name individual providers on this page while contracts are being finalised, because a published name that later changes is worse than a category that stays accurate. The current named register is available on request, and we give 30 days' notice before any change — see Section 5.
⚠️ Some AI processing happens outside the UAE. We use appropriate transfer safeguards. If you would prefer nothing left the UAE, do not use AI features — everything else is processed here.
ℹ️ We contractually require AI providers not to train on data we send them.
What is NOT on this list
We want to be specific, since absence is the point:
- ❌ No advertising networks — we don't sell advertising
- ❌ No behavioural analytics providers — no Google Analytics, no Meta Pixel, no TikTok Pixel
- ❌ No data brokers or audience platforms
- ❌ No marketing automation built on your behaviour
- ❌ No AI training partners
What sub-processors cannot access
None of our sub-processors can read your end-to-end encrypted messages. Our cloud provider stores ciphertext. The keys are on your device and nowhere else — not with us, and not with them.
→ How encryption works
Changes to this list
We give 30 days' notice before adding or replacing a sub-processor that processes personal data.
To be notified: subscribe at letshoraro.com/legal/sub-processors, or email privacy@letshoraro.com asking to be added to the list.
For business customers
If you reasonably object to a new sub-processor on data protection grounds within the notice period, we'll work in good faith to find an alternative. If we can't, you may terminate the affected service and receive a pro-rata refund. → Business Terms & DPA §15
Change history
| Date | Change | Provider | Purpose |
|---|---|---|---|
| 19 May 2026 | Page published at category level | — | — |
Questions
Users: privacy@letshoraro.com
Business customers and procurement: billing@letshoraro.com — we can provide our DPA, security documentation and, where applicable, Standard Contractual Clauses.
Data Protection Officer: dpo@letshoraro.com