Sub-processors
Last updated: 8 November 2026
Intake Plus uses a small number of established providers to answer calls, send intake links, prepare briefs and store records. We list them here so firms can see exactly who is involved and why.
How data is handled. Enquiry records and documents are kept in our primary cloud database and private storage, protected by sign-in, multi-factor authentication for firm staff, and access rules that keep each firm’s data separate. Other providers receive only the information needed for their task, and handle it under their own published privacy terms. Some processing happens outside Australia.
If your firm needs specific details — such as processing locations or provider terms for your setup — contact us and we’ll walk you through them before you go live.
| Sub-processor | Region | Purpose | Data categories | Privacy |
|---|---|---|---|---|
| Supabase | Sydney, Australia (primary database, sign-in and file storage) | Primary database, sign-in and private file storage | Firm accounts, enquiry records, transcripts, intake answers and uploaded documents | View |
| Lovable | May be processed outside Australia | Application hosting and secure gateways for AI and SMS | Information needed to run intake, generate questions and briefs, and send SMS | View |
| Vapi | May be processed outside Australia | AI voice reception and call handling | Call audio, transcripts, enquiry details and call metadata | View |
| Twilio | May be processed outside Australia, including the United States | Phone numbers and SMS delivery | Phone numbers, call metadata, verification codes and intake-link messages | View |
| OpenAI / Google Gemini | May be processed outside Australia | AI models used to prepare intake questions, summaries and draft briefs | Intake content and uploaded documents relevant to the enquiry | View |
| Zapier | United States; data may also be processed by subprocessors in other jurisdictions | Workflow automation for configured practice-management integrations, including transferring approved enquiry, contact and matter-related information to connected firm systems | Only the client contact details, enquiry or matter metadata, intake summary or notes and other fields configured for the specific firm's integration, where applicable | View |
| Email delivery (Lovable Email / Resend) | May be processed outside Australia | Notifications and transactional email | Recipient addresses and message content, such as contact details and matter type | View |
Practice-management integrations
Where a firm has an integration with LEAP, Actionstep or Clio configured, information from approved enquiries is transferred through Zapier to the firm’s connected system. Zapier states that it transfers and stores customer content in the United States — see its data transfer impact assessment and data processing addendum. These transfers are not limited to Australia. Once received, the information is held in the firm’s own practice management system under the firm’s arrangements with that provider.
Cross-border disclosure (APP 8)
Where a sub-processor is located outside Australia, IntakePlus takes reasonable steps to ensure the recipient handles personal information in a manner consistent with the Australian Privacy Principles. Customer law firms remain responsible for notifying their own clients of these disclosures where required.
AI processing
AI is used only to support intake — asking relevant questions, summarising what the client said and preparing a draft brief for a lawyer to review. It never gives legal advice. AI requests are sent through Lovable’s secure gateway, and each model provider handles data under its own terms; we don’t claim zero retention or a no-training guarantee beyond what those terms provide. Voice calls may also use speech services supplied through Vapi.