Legal
Sub-processors
Last updated 20 October 2026 · Effective 20 October 2026
These are the companies that Nkonso Technologies Ltd uses to run Agoo and that may process personal data our customers keep in it. This list is part of our data processing agreement, and we keep it separate because it changes more often.
On this page
Current sub-processors
Agoo is in early access. Where a provider applies only once a feature is turned on or launched, the last column says so. Each one processes personal data only to provide its service to us, under a written contract that requires confidentiality and security.
| Provider | What it does for Agoo | Personal data | Location | When it applies |
|---|---|---|---|---|
| Supabase | Hosts the database where Agoo keeps your organisation’s records, with encrypted backups. | All data held in Agoo: account and sign-in details, and the visitor, booking, attendance and audit records your organisation keeps | United Kingdom | Always (core service) |
| Vercel | Hosts Agoo’s website, documentation and web apps. | Technical request data (IP address, browser, pages requested); enquiry form submissions; data shown in the web apps as it passes through | United Kingdom, with a global delivery network | Always (core service) |
| Cloudflare | Protects and delivers Agoo’s services, stores the files kept in Agoo, such as photos, signatures, documents, leave certificates and the exports and payroll files your organisation makes, and runs Agoo’s status page. | Technical request data (IP address, request details); files kept in Agoo, such as visitor photos, ID images, signatures, leave certificates, exports and payroll files; status page subscribers’ email addresses | Global network; files stored in Western Europe | Always (core service) |
| Fly.io | Hosts Agoo’s application servers. | Data processed by Agoo’s services while it is being processed | United Kingdom | Always (core service) |
| PowerSync | Lets Agoo’s kiosk and staff apps keep working without a connection. | The records a device needs for its own site, such as the day’s expected visitors | European Union | When your organisation uses Agoo’s kiosk or staff apps |
| Twilio SendGrid | Delivers Agoo’s email: passes, invitations, notifications, sign-in links and codes, visitors’ copies of documents they sign, invoices, status updates and replies to enquiries. | Recipient name and email address, message content, delivery status | United States | Always (core service) |
| Hubtel | Delivers Agoo’s SMS messages in Ghana, such as passes, host alerts, sign-in codes, codes that confirm a visit request and roll-call links. | Recipient phone number, message content, delivery status | Ghana | Always (core service) |
| Meta | Delivers WhatsApp messages. | Recipient phone number, message content, delivery and read status | Global (Meta’s data centres) | Only when your organisation turns WhatsApp on |
| Apple (Apple Push Notification service) | Delivers Agoo’s notifications to the Agoo Workspace app on iPhone and iPad, such as a visitor’s arrival, an approval to give or an emergency roll call, and to the Agoo Reviews app, such as a business’s reply to your review. | The notification’s text (which names the visitor unless the organisation chooses to leave names out), the device token Apple gives the app, and a random code the phone sends back to confirm delivery | United States | For people who use the Agoo Workspace or Agoo Reviews app on iPhone or iPad with notifications turned on |
| Google (Firebase Cloud Messaging) | Delivers Agoo’s notifications to the Agoo Workspace app on Android phones and tablets, such as a visitor’s arrival, an approval to give or an emergency roll call, and to the Agoo Reviews app, such as a business’s reply to your review. Agoo uses no Google analytics or advertising in the apps. | The notification’s text (which names the visitor unless the organisation chooses to leave names out), the device token Google gives the app, and a random code the phone sends back to confirm delivery | United States | For people who use the Agoo Workspace or Agoo Reviews app on Android with notifications turned on |
| Paystack | Takes card and Mobile Money payments for plans, top-ups and invoices. Card and Mobile Money details go straight to Paystack and are never stored by Agoo. | The Owner’s email, payment amount and reference, payment method details (held by Paystack) | Ghana, Nigeria | When your organisation pays for a plan, top-up or invoice |
| Anthropic | Provides the Claude models behind Agoo AI: Ask Agoo, ID reading when the kiosk can’t read an ID itself, logbook digitising and drafting. When an organisation turns on reading parcel labels, it reads the photo of each parcel’s label to suggest who it’s for, with the courier and tracking number; a person always chooses. On Agoo Reviews it reads each review against the guidelines before it appears, to hold for a person anything that may break them, and, when a business asks, drafts a reply to a review or summarises its reviews for the business to read and edit. On Agoo Forms, when a maker asks, it drafts a form from their description, for them to check, change and publish themselves, and it reads the words of forms new workspaces publish, and some others such as reported ones, against the safety policy, to hold for a person anything that may break it. Anthropic’s commercial terms don’t allow it to train models on this data. | The content of each AI task, with personal details removed where the task doesn’t need them; cropped ID images (never of a Ghana Card) and logbook photos when those features are used; the photo of a parcel’s label (which may show the recipient’s and sender’s names and addresses), never the parcel’s other photos, the rider’s details or the organisation’s directory; the title and words of each review on Agoo Reviews, without the reviewer’s name or contact details (and, for screening, without its stars); for a reply draft or summary, the business’s name and kind, the reviews’ stars and words, its existing reply and any note the business adds; for an Agoo Forms draft, the maker’s description of the form and who it’s for; for an Agoo Forms safety check, the form’s words and the name of whoever it says it’s from; never anyone’s answers | United States | Agoo AI: only when your organisation turns it on. Parcel labels: only when your organisation turns on reading labels with AI, for each label photo taken while it’s on. Agoo Reviews: every review written there, and each reply draft or summary a business asks for. Agoo Forms: each draft a maker asks for, and the safety check of forms new workspaces publish and of some others, such as reported ones |
Planned
These providers are part of Agoo’s planned architecture but don’t process customer personal data yet. Each will be added to the list above, with its location, and customers given at least 30 days’ notice, before it does.
- An error-monitoring provider: Finding and fixing errors in Agoo’s apps; named here before it processes any personal data.
- A service-monitoring provider: Keeping Agoo fast and available; named here before it processes any personal data.
- A second SMS provider in Ghana: Backup SMS delivery if Hubtel is unavailable.
Services you connect
When your organisation, or one of its people, connects one of these, Agoo sends data to it on that instruction. It acts for your organisation or that person under their own agreement with its provider, so it isn’t our sub-processor. Google, Microsoft and Zoom are connected by each person with their own account, and can be disconnected at any time.
- Google: Single sign-on, and connected Google calendars with Google Meet links. Data: For a connected calendar: the events Agoo adds for a person’s confirmed bookings and their Meet links, saying as much as the organisation allows (at most the guest’s name and company, the kind of booking and where; at least only the time). Location: Global (Google’s own infrastructure). When: Only when a person signs in with Google or connects their own Google account.
- Microsoft: Single sign-on, and connected Microsoft 365 and Outlook.com calendars with Teams links. Data: For a connected calendar: the events Agoo adds for a person’s confirmed bookings and their Teams meetings, saying as much as the organisation allows. Location: Global (Microsoft’s own infrastructure). When: Only when a person signs in with Microsoft or connects their own Microsoft account.
- Zoom: Zoom meeting links for video bookings. Data: The Zoom meetings Agoo makes in a host’s own account for their video bookings: the time, the length and a topic (the kind of booking with the guest’s name, or with the organisation’s name instead), with the waiting room on and recording off. Location: Global (Zoom’s own infrastructure). When: Only when a host connects their own Zoom account and a booking type makes Zoom links.
- Your identity provider: SAML single sign-on and SCIM provisioning, when your organisation sets them up.
- AI assistants you connect: Assistants (such as Claude or ChatGPT) that your people connect to Agoo through the MCP server.
- Your webhook endpoints and apps: Systems your organisation sends Agoo data to through webhooks, the API or OAuth apps.
Services a visitor chooses
A visitor can choose to keep their pass in their phone’s wallet. Agoo sends the pass to the wallet’s provider only when the visitor asks it to, and the provider holds it for the visitor under its own terms and privacy policy, so it isn’t our sub-processor. Nothing is sent if the visitor doesn’t add the pass.
- Apple (Apple Wallet), Google (Google Wallet): Keep a visitor’s pass in their phone’s wallet, and bring it the pass’s updates. Data: The pass: the visitor’s name, the organisation, the host, the site and its address, the time of the visit and the pass’s code. Location: Global (Apple’s and Google’s own infrastructure). When: Only when a visitor chooses Add to Apple Wallet or Add to Google Wallet.
Changes to this list
We tell customers at least 30 days before a new sub-processor starts processing their personal data, by email to the Owner and by updating this page. Customers can object on reasonable data protection grounds, as the data processing agreement describes. Questions about this list can be sent to agoo@ardentafrica.com.