Skip to content
Policy Center

SunniNikah — Third-Party Services Disclosure

Effective Date: 19/08/2026
Status: Production configuration baseline

SunniNikah uses selected third-party services to host, store, secure, communicate, distribute and operate the platform. This register should be updated whenever a production vendor, SDK, cloud service, communication provider, monitoring service or payment service is added or removed.

1. Current Production Stack

Cloudflare
├── DNS / Proxy / TLS / WAF
├── Pages → sunninikah.com
├── Pages → admin.sunninikah.com
└── R2 → private uploaded media

Hostinger KVM4
├── Nginx
├── NestJS API + PM2
├── PostgreSQL
├── PgBouncer
└── Redis

External communications
├── MSG91 → primary India OTP
├── 2Factor → SMS fallback
├── Twilio → final/global SMS fallback
└── SendGrid → transactional email

App distribution / billing
├── Apple App Store / Apple services
└── Google Play / Google services

PostgreSQL, Redis, PgBouncer, Nginx, PM2 and NestJS are self-hosted/open-source components and are not external data-processing vendors.

2. Current Vendor Register

| Vendor | Service / Purpose | Data Categories Potentially Processed | Region / Transfer | Contract / DPA | Privacy / Legal | |---|---|---|---|---|---| | Cloudflare | DNS, CDN/proxy, TLS, WAF, Pages | IP/request metadata, security logs, website/admin assets, R2 objects/metadata where applicable | Global infrastructure; depends on product/configuration | Review applicable Cloudflare terms/DPA | https://www.cloudflare.com/policies/privacy/ | | Hostinger | KVM4 VPS hosting | User/application data hosted on VPS, server logs, network metadata, backups, account information | Depends on selected hosting location | Review Hostinger DPA/hosting terms | https://www.hostinger.com/legal/ | | Cloudflare R2 | Private object storage | Profile images, uploaded media, object metadata/access metadata | Depends on R2 configuration | Cloudflare terms/DPA | https://www.cloudflare.com/policies/privacy/ | | MSG91 | Primary India OTP/SMS | Phone number, OTP/message content, delivery/API metadata | India/telecom routing as applicable | Review MSG91 agreement/DPA | https://msg91.com/privacy-policy | | 2Factor | SMS/OTP fallback | Phone number, OTP/message content, delivery/API metadata | India/telecom routing as applicable | Review provider terms/privacy | https://2factor.in/v2/tos.html | | Twilio | Final/global SMS fallback | Phone number, SMS/OTP content, delivery/service metadata | Global infrastructure; depends on product/configuration | Review Twilio DPA | https://www.twilio.com/en-us/legal/privacy | | SendGrid (Twilio) | Transactional email | Email address, sender/recipient metadata, email content, delivery metadata | Depends on service configuration | Review applicable Twilio/SendGrid DPA | https://www.twilio.com/en-us/legal/privacy | | Apple | iOS distribution and App Store purchases | Store/account, device/app and transaction information processed by Apple | Apple global infrastructure / applicable regional services | Apple developer/App Store agreements | https://www.apple.com/legal/privacy/ | | Google | Android distribution and Google Play purchases | Store/account, device/app and transaction information processed by Google | Google global infrastructure / applicable regional services | Google developer/Play agreements | https://policies.google.com/privacy?hl=en-IN |

3. Cloudflare

Cloudflare provides the public edge layer:

  • DNS for sunninikah.com;
  • proxy/CDN/TLS/WAF for public traffic;
  • Cloudflare Pages for sunninikah.com;
  • Cloudflare Pages for admin.sunninikah.com;
  • Cloudflare R2 for private uploaded media.

Potentially processed data includes IP addresses, request metadata, security logs, website/admin assets and R2 object data/metadata.

Official privacy policy:
https://www.cloudflare.com/policies/privacy/

4. Hostinger

Hostinger provides the KVM4 VPS for the initial production backend infrastructure.

The VPS hosts:

NestJS API
PostgreSQL
Redis
PgBouncer
Nginx
PM2

Potentially stored/processed data includes application/database data, server logs, network metadata, backups and hosting-account information.

The actual production data-center location should be recorded separately from the vendor name; do not claim that data remains in India unless the selected hosting location and contractual terms establish that.

Official legal resources:
https://www.hostinger.com/legal/

5. Cloudflare R2

R2 is used as private object storage for uploaded media, including profile images.

The production bucket is private. Clients receive signed/presigned access rather than R2 credentials.

Potential data:

  • profile images;
  • uploaded media;
  • object keys/metadata;
  • upload/download access metadata.

Official Cloudflare privacy policy:
https://www.cloudflare.com/policies/privacy/

6. SMS Providers

The production server-side failover chain is:

MSG91
   ↓ failure
2Factor
   ↓ failure
Twilio

One OTP is generated and providers are attempted sequentially. The client does not select the provider.

MSG91

Primary India OTP provider.

Potential data:

  • phone number;
  • OTP/message content;
  • delivery status;
  • API/account metadata.

Official privacy policy:
https://msg91.com/privacy-policy

2Factor

Fallback SMS/OTP provider.

Potential data:

  • phone number;
  • OTP/message content;
  • delivery metadata;
  • API/account information.

Official terms/privacy resource:
https://2factor.in/v2/tos.html

Twilio

Final fallback and global messaging provider.

Potential data:

  • phone number;
  • SMS/OTP content;
  • delivery metadata;
  • service/account metadata.

Official privacy resources:
https://www.twilio.com/en-us/privacy
https://www.twilio.com/en-us/legal/data-protection-addendum

7. SendGrid

SendGrid, operated within Twilio, provides transactional email.

Potential data:

  • recipient email address;
  • sender information;
  • subject/content;
  • delivery/bounce metadata;
  • API/account metadata.

Production sender:

no-reply@sunninikah.com

Official Twilio privacy resources:
https://www.twilio.com/en-us/privacy

8. Apple

Apple may process information when users download/install the iOS app or purchase through Apple's App Store/in-app purchase system.

SunniNikah does not receive or store Apple account passwords.

Official privacy policy:
https://www.apple.com/legal/privacy/

9. Google

Google may process information when users download/install the Android app or purchase through Google Play/Google Play Billing.

SunniNikah does not receive or store Google account passwords.

Official privacy policy:
https://policies.google.com/privacy?hl=en-IN

10. Deferred / Optional Services

These must not be represented as active production vendors until actually enabled.

Firebase Cloud Messaging (FCM)

Status: Deferred

FCM push delivery is not an active production dependency in the current backend.

When implemented, update this document with the Firebase/Google data flow, device-token handling, SDK details and applicable privacy information.

Sentry / Error Monitoring

Status: Optional

Only list Sentry as a current vendor after the production SDK/account is actually enabled. If enabled, document error/crash data, device/app metadata, user identifiers, retention and region.

Uptime Monitoring

Status: Optional

Only list the selected uptime-monitoring provider after it is actually configured.

Web Payments

Status: Deferred

Razorpay, Stripe or another web-payment provider should not be listed as a current vendor until browser-based payments are actually implemented.

11. Data Minimization

Configure third-party services with the minimum data required for their purpose.

Examples:

  • SMS providers receive the phone number/message required for OTP delivery.
  • SendGrid receives the information required for transactional email.
  • R2 stores uploaded media rather than unnecessary profile metadata.
  • Cloudflare receives network/request information needed for DNS, proxy, security and hosting.
  • Apple/Google process store and billing information within their platforms.

Production logs should not unnecessarily contain:

  • plaintext OTPs;
  • passwords;
  • JWT secrets;
  • API keys;
  • R2 secret keys;
  • payment secrets;
  • unnecessary sensitive profile information.

12. International Data Transfers

Some vendors operate global infrastructure. Actual storage/processing location can vary by product, account configuration, telecom route and region.

Do not state that all SunniNikah data remains in India unless the relevant vendor configuration and contractual terms establish that.

Before finalizing public privacy documentation, record:

  1. vendor;
  2. service;
  3. data categories;
  4. processing region;
  5. transfer mechanism where relevant;
  6. DPA/contract status;
  7. retention/deletion terms.

13. Internal Contract / DPA Checklist

| Vendor | Review Required | Status | |---|---|---| | Cloudflare | Terms / DPA | [ ] | | Hostinger | Hosting terms / DPA | [ ] | | MSG91 | Agreement / DPA | [ ] | | 2Factor | Agreement / privacy terms | [ ] | | Twilio | DPA | [ ] | | SendGrid/Twilio | Applicable Twilio/SendGrid terms | [ ] | | Apple | Developer/App Store agreements | [ ] | | Google | Developer/Play agreements | [ ] |

Do not mark a vendor as approved until the actual production account agreement/DPA has been reviewed.

14. Vendor Change Control

Update this document whenever:

  • a new SDK is added;
  • a new cloud service is enabled;
  • an SMS/email provider is added or removed;
  • analytics is added;
  • crash reporting is enabled;
  • FCM is enabled;
  • web payments are introduced;
  • storage providers change;
  • a production data flow materially changes.

Before every production release, compare this register against:

Backend integrations
Mobile SDKs
React/Admin dependencies
Cloudflare services
Docker services
External APIs
Payment integrations
Monitoring tools

15. Production Vendor Checklist

  • [ ] Cloudflare DNS configured.
  • [ ] Cloudflare Pages configured for sunninikah.com.
  • [ ] Cloudflare Pages configured for admin.sunninikah.com.
  • [ ] Cloudflare R2 production bucket private.
  • [ ] Hostinger KVM4 production VPS configured.
  • [ ] MSG91 DLT/OTP configuration approved.
  • [ ] 2Factor fallback configured.
  • [ ] Twilio fallback configured where required.
  • [ ] SendGrid domain authentication verified.
  • [ ] Apple App Store configuration reviewed.
  • [ ] Google Play configuration reviewed.
  • [ ] Applicable DPA/contract status reviewed.
  • [ ] Public privacy policy matches actual production vendors.
  • [ ] Deferred services are not presented as active vendors.

16. Important Notice

This is an operational third-party vendor register and disclosure baseline. It does not replace the SunniNikah Privacy Policy, Terms of Service, Community Guidelines, consent notices, App Store disclosures, Google Play disclosures, contracts, DPAs or other legally required documentation.