Legal · Who helps us
Companies that help us run Pasal
Last updated 26 August 2026
This is the full list of companies that hold or handle data as part of Pasal, lifted out of the Privacy Policy so it can be read on its own and kept up to date on its own. It is complete as of the date above. If it changes, we will update this page and tell shop owners before the change takes effect. Nothing here is sold to anybody: each company handles data to do its part and nothing more.
- 01
Supabase
What they do. The database, sign-in, file storage and the server functions Pasal runs on.
What reaches them. Everything Pasal stores: owner, staff and shopper accounts; orders with customer names, phones, emails and delivery addresses; khata; loyalty; bookings; tickets; repair jobs; the Ledger; catalog photographs; and customers' payment screenshots.
Where. On Supabase's servers, outside Nepal. Ask us and we will tell you the country.
- 02
Vercel
What they do. Hosts and serves pasal.studio, every storefront and the server side rendering, and attaches a shop's claimed subdomain.
What reaches them. Every request it serves, so visiting IP addresses, browsers and requested pages, in its logs. The subdomain a shop claims.
Where. Server functions in Mumbai, India. Its network is worldwide.
- 03
Resend
What they do. Delivers every email Pasal sends, including the sign-in codes sent through Supabase.
What reaches them. The recipient's address and the whole message: order contents, customer name, phone and delivery address, invoice numbers, a shop's registered legal name and PAN, receipt and ticket PDFs, sign-in codes, and the owner's daily summary email including today's bookings by name and phone.
Where. Outside Nepal. Ask us and we will tell you the country.
- 04
Anthropic
What they do. Powers the help assistant and the AI product writer in the shop dashboard.
What reaches them. From the assistant: the question an owner types and the last six messages of that conversation, each cut to 2,000 characters; which features the shop has switched on; and whether each figure on the dashboard is a number, a zero, a book that account may not read, a book the shop does not keep, or a reading that did not load. No amount, order, customer record or customer name is attached. Their answer comes back with named blanks in it. The figures themselves, and the names on the shop's khata, go to Pasal's own server instead, and it fills those blanks in after the model has answered. From the writer: the product an owner pressed the button on, which is its name, price, unit, description, category and its first photo, plus the categories the shop already uses and the shop's name, trade and area. Pasal sends the link to that photo and Anthropic fetches it, so the photograph itself reaches them and the model sees it. It is the product photo the shop already publishes on its own storefront.
Where. United States.
- 05
eSewa
What they do. Payment gateway. A shop can connect its own merchant account for its customers' payments, and Pro plans would be paid to us this way.
What reaches them. The amount, a transaction id we issue, a merchant product code and a signature. A shopper's browser is sent to eSewa, so eSewa also sees them and whatever they give its own login. No card, bank or account number reaches Pasal at any point.
Where. Nepal.
- 06
Google, for two typefaces
What they do. Serve two typefaces, Space Mono and Caveat, requested by your browser on every page of pasal.studio and every storefront.
What reaches them. The visitor's IP address, browser and the page they are on, on every page load, requested by their browser directly.
Where. Worldwide.
- 07
Google, Mozilla or Apple, for push
What they do. Deliver order alerts to a shopkeeper's device. Which company is involved is decided by that person's browser, not by Pasal. A customer's phone is told separately when a card in their wallet changes; that path is the wallet entry below, not this one.
What reaches them. The device subscription and the fact that an alert was sent. The alert content is encrypted to the device.
Where. Worldwide.
- 08
Apple and Google, for wallet passes
What they do. Hold a loyalty card or an event ticket in the wallet app on a customer's phone, when that customer chooses to add one.
What reaches them. The two are not the same, and the difference is worth knowing. A Google pass is built on Google's servers, so what is on the card reaches Google: the name on it, the points balance, and for a ticket the event's name, date, venue and the ticket code itself. One thing to know about that name. If you have not told us what to call you, and you have not ordered from that shop before, the name on the card is your email address, because a card reading MEMBER and a string of letters helps nobody at a counter. So for some people it is an email address that reaches Google, not a display name. An Apple pass is a file we sign and the phone keeps, so what is written on it does not go to Apple. What Apple gets is the token used to tell a phone that its card has changed, and the fact that we sent one.
Where. Worldwide.
- 09
OpenStreetMap, for finding a place on a map
What they do. Turn an address into a pair of coordinates. A shop uses this to put a pin on its loyalty card, and an event uses it to put one on its venue, so a wallet pass can show itself when the person holding it is nearby. It runs when somebody presses the button that looks an address up, and at no other time.
What reaches them. The address text, and nothing else. Our server asks, not your browser, so they are not told which shop asked and they never see your visitors or their addresses.
Where. Europe, run by the OpenStreetMap Foundation.
- 10
Unsplash and Pexels
What they do. Host the stock photography used on Pasal's own demo shops at pasal.studio/demo and on the pages that preview a template while a shop is being set up. A shop's own catalog uses photographs its owner uploaded, which are stored with Supabase.
What reaches them. The visitor's IP address, browser and the page they are on, when that page is one of our demo shops or a template preview.
Where. Canada and Germany, served worldwide.
- 11
Cloudflare
What they do. Answer the name service for pasal.studio, so a browser asking where Pasal lives gets a reply, and carry the traffic on its way to us.
What reaches them. The visitor's IP address and the address being looked up. This happens before any page loads, for every visitor, and it is unavoidable for any site on the internet: somebody has to answer that question.
Where. Worldwide, from whichever of their locations is nearest the visitor.