OnePlanner Subprocessors

This list is referenced by our Privacy Policy. We will give at least 14 days' notice before adding or replacing a subprocessor that will handle personal data, so Firms can object per their data processing agreement.

Last reviewed: July 23, 2026

Subprocessor	Purpose	Data involved	Location
Supabase	Database hosting, authentication	All account and client financial data stored in the platform	To be confirmed
OpenAI	AI-generated insights, report drafting	Client financial data submitted to AI features (fact-find, reports)	United States
Google (Gemini API)	AI-generated insights, report drafting	Client financial data submitted to AI features	United States
Exa	AI-assisted search	Search queries issued by AI features; not intended to include raw client PII	United States
PostHog	Product analytics	Usage/event data, page views, autocapture	To be confirmed
Google Sheets (service account)	Waitlist / demo request storage (landing page)	Name, email, phone submitted via the "Join Waitlist" form	To be confirmed
Google Analytics (GA4)	Web analytics (landing page only, separate from the CRM app)	Usage/event data on marketing site	United States
Hosting provider	Application hosting	N/A (infrastructure)	To be confirmed
Curlec (Razorpay Malaysia)	Billing Firms for subscriptions — FPX and card payments	Firm billing contact and payment details	Malaysia

Curlec integration is in progress as of this writing — credentials and plan configuration exist but the checkout/webhook flow is not yet live in production. This table reflects the intended end state. See our Refund and Billing Policy for how billing is handled until then.

Every subprocessor that receives personal data transferred outside Malaysia needs a PDPA-compliant transfer basis (PDPA Section 129 — the destination country must have a comparable level of protection, or an exception applies, such as consent). OpenAI, Gemini, and GA4 processing typically involves US infrastructure; the specific transfer basis relied upon should be confirmed with qualified counsel.

Our key subprocessors maintain independent third-party security certifications (for example, SOC 2 Type II) as part of their own compliance programs. Documentation of a subprocessor's certifications, or a copy of our data processing agreement with them, can be requested at support@oneplannerapp.com.