RetrieverCompanies that help us run Retriever
Last updated 30 October 2026
This lists providers and other recipients that handle data as part of Retriever (formerly Pasal), lifted out of the Privacy Policy so it can be read on its own and kept up to date on its own. Retriever is operated by Retriever Labs Pvt. Ltd., Bhaktapur, Nepal. It is complete as of the date above. If it changes, we will update this page and tell shop owners before the change takes effect. Retriever does not sell this data. Providers handle it for their service; independent recipients such as IRD and Google also have their own rules and policies.
- 01
Supabase
What they do. The database, sign-in, file storage and the server functions Retriever runs on.
What reaches them. Everything Retriever stores: owner, staff and shopper accounts; orders with customer names, phones, emails and delivery addresses; khata; loyalty; bookings; tickets; repair jobs; payslips, with the wages and the deductions on them and the employee PANs a shop has recorded; the Ledger; catalog photographs; customers' payment screenshots; unit serial/IMEI and movement records; review queues, prepared messages and opt-outs; plan billing; permit history; audit logs and archives; a shop's Instagram, Messenger and WhatsApp inbox: customers' messages, their Meta IDs, names and photos, and the encrypted access tokens; and messages to Retriever's own Instagram and Facebook accounts.
Where. On Supabase's servers, outside Nepal. Ask us and we will tell you the country.
- 02
Vercel
What they do. Hosts and serves retriever.com.np, every storefront and the server side rendering, and attaches a shop's claimed subdomain.
What reaches them. Every request it serves, so visiting IP addresses, browsers and requested pages, in its logs. The subdomain a shop claims. A shop's Inbox: customers' messages, their IDs, names and photo links on their way from the database to the owner's browser, the replies and product cards the shop sends on their way to Meta, Retriever's requests to Meta for a customer's name and photo, and the steps that connect or disconnect an account.
Where. Server functions in Mumbai, India. Its network is worldwide.
- 03
Resend
What they do. Delivers every email Retriever sends, including the sign-in codes sent through Supabase.
What reaches them. The recipient's address and the whole message: order contents, customer name, phone and delivery address, invoice numbers, a shop's registered legal name and PAN, receipt and ticket PDFs, sign-in codes, the owner's daily summary email including today's bookings by name and phone, and, on a payslip email, one person's wages: their name, the period, every earning and deduction line, the totals, the net, and the payment reference. That last one is the heaviest thing that leaves Retriever for a subprocessor, so it is named separately rather than left inside the words "the whole message". No PAN of the employee's goes with the payslip mail. Resend also receives plan invoice billing details, review invitation names and visit descriptions, review URLs and tokenized opt-out links, and, for a back-in-stock alert, the shopper's email address, the item and option, a link to the item and a link to stop, sent in the shop's name with its logo and with the shop's contact email as the reply-to address, and, for a shop page chat, the visitor's email address with a link to confirm it, and once confirmed the shop's reply (up to five replies) and a link back to the chat, sent as the shop's name via Retriever.
Where. Outside Nepal. Ask us and we will tell you the country.
- 04
OpenAI, for Zuno
What they do. Answers help questions in the Retriever dashboard through the Responses API.
What reaches them. Your question and the last six messages, each cut to 2,000 characters, which shop features are on, and whether each dashboard figure is readable, zero, unavailable or missing. Retriever sends named blanks instead of dashboard amounts, khata names, orders or customer records, then fills those blanks on its own server after the answer comes back. Anything personal you type into your question or history still goes with that text, so do not paste customer details into Zuno.
How they hold it. Retriever sets response storage off. API data is not used to train OpenAI models by default. This does not disable OpenAI's abuse-monitoring logs, which may retain customer content for up to 30 days, unless longer retention is required by law or reasonably necessary to protect OpenAI services or others from harm. See OpenAI's API data controls.
Where. OpenAI processes the API request outside Nepal.
- 05
Anthropic
What they do. Powers the AI product writer and Add from photo in the shop dashboard, and automatic product help in a shop's Instagram inbox, its Messenger and WhatsApp inboxes and its shop page chat where Retriever has switched it on. On Instagram, Messenger and WhatsApp product help is off unless the shop's owner turns it on after being told Anthropic is the provider. On a shop page chat it is on by default, unless the shop turns it off, and the chat tells visitors replies may be automatic.
What reaches them. From the writer: the product an owner pressed the button on, which is its name, price, unit, description, category and its first photo, plus the categories the shop already uses and the shop's name, trade and area. Retriever sends the link to that photo and Anthropic fetches it, so the photograph itself reaches them and the model sees it. It is the product photo the shop already publishes on its own storefront. From Add from photo: a photo the owner has just taken or chosen, sent as the picture itself after the owner's browser has shrunk it and saved it again without its location or camera details, with the shop's name, trade and area and its category names. This photo is not yet on the storefront. No price, stock or customer record goes with it. From product help, when a customer's message is not something Retriever's own matching can answer: that message as the customer typed it, including anything personal they wrote in it, and the shop's public catalogue of up to 100 products, meaning names and codes, prices, sizes and colours with whether each is in stock, units, photo links and the shop's web address. Not the customer's name, photo or ID, other messages, buying prices or stock counts.
How they hold it. Anthropic handles everything Retriever sends it for Retriever, under its commercial terms and data processing addendum, which do not allow it to train its models on it. Anthropic deletes it within 30 days, unless its safety systems flag it as breaking Anthropic's usage policy, when it can keep it for up to two years, or the law requires longer. Deleting something in Retriever does not delete Anthropic's copy.
Where. United States.
- 06
PostHog, for product analytics
What they do. Product analytics for Retriever's own pages: how shop owners move from signing up to opening a shop, adding a first product, taking a first order and paying for a plan, so we can see where they get stuck.
What reaches them. From Retriever's own pages, never a shop's: each page opened, with every sign-in code, token, order link and search taken out of the address and the referring site cut to its name; the browser's name, operating system, device type and screen size; its IP address; and a random browser ID. For a signed-in owner or staff member: their Retriever account number, which is a random code and not their email or name, and whether they are the owner or staff. Their shop, as a group: its internal number, web address name (slug), trade and plan. Named steps: starting sign-up, opening a shop, adding the first product, an order being created, and starting and finishing a Retriever Pro payment. For an order: its number, online or counter, which screen it came from, how many items, the total in rupees, and whether it was for a table or delivery. Never a customer's name, phone, email, address or note. From a shop's own page: only that order line when an order is placed, under a new random ID with no profile and no cookie. Shoppers browsing a shop are not sent at all. No session recordings, no capture of clicks or typing, no heatmaps and no surveys.
Error reports and AI assistant use. When the code on a Retriever page or a shop's page fails: the kind of error, its message with email addresses, phone numbers, long digit runs such as PAN, codes, tokens, names and places, and anything quoted or in Nepali removed, the file, line and function in Retriever's code, the page's address without its query and with ids replaced, and Retriever's version; at most twenty per page per visit. From a shop's page, under a new random ID with no profile. From Retriever's server, for each tool a connected AI assistant uses: the tool's name and kind, which assistant (ChatGPT, Claude or another), whether it was answered or the refusal reason, how long it took, the shop's internal number and the person's Retriever account number. Never the question, the answer, or any shop or customer data.
Saying no. A browser with Do Not Track or Global Privacy Control on sends nothing, and so does one that has opened a page with
?analytics=off(undone with?analytics=on). The details are in the Privacy Policy.Where. United States (us.posthog.com).
- 07
Meta, for Instagram, Messenger and WhatsApp
What they do. Run Instagram, Facebook Messenger and WhatsApp. A shop can connect its own account there so its customers' messages arrive in its Retriever inbox, and Retriever answers messages to its own Instagram account and, once that is switched on, its own Facebook Page. Meta is the platform the conversation happens on, so it holds every conversation under its own terms and privacy policy whether or not Retriever is connected.
What reaches them. The replies and product cards Retriever sends on a shop's behalf or its own: the reply text, and for a product its name, price, photo and website link, plus its code when automatic product help sends it. Requests for the name and profile photo of a customer who messaged a connected account. The calls that connect, renew and disconnect an account, with the shop's access token. A shop owner's browser also loads customers' profile photos from Meta's servers in the Inbox. Separately, the recipient's number, the prefilled text, or both in a WhatsApp link opened from Retriever, such as a counter receipt or a thank-you.
Where. Outside Nepal, under Meta's own policies.
- 08
Fonepay, for Retriever Pro
Processes QR plan payments. Our requests carry amount, merchant/terminal identity, payment reference and a generic plan description; they do not carry the buyer's stored billing contact fields. Status responses let Retriever record settlement. Your bank or wallet handles its own payment credentials.
Fonepay is in Nepal. Billing details remain in Retriever and reach Resend when a plan invoice is emailed.
- 09
IRD and Google review links
These are independent recipients rather than hosting providers. IRD Live submission is disabled while Retriever's software approval is pending. An explicitly enabled CBMS test sends test bill/reference numbers, dates and financial totals using the published test identity; buyer identity and return free text are removed. A saved taxpayer permit or successful test does not enable live filing.
A separately authorized inspector can read billing records, including their customer fields, for shops in its assigned PAN scope. This access is granted by a platform operator, not automatically by connecting Test mode.
Following a shop's Google review link opens Google in the recipient's browser under Google's own policies. Retriever does not automatically send Google the customer's purchase record, post reviews or fetch review text or ratings.
- 10
eSewa
What they do. Payment gateway. When Retriever offers it, a shop can connect its own merchant account for its customers' payments. Retriever Pro QR payments use Fonepay instead.
What reaches them. The amount, a transaction id we issue, a merchant product code and a signature. A shopper's browser is sent to eSewa, so eSewa also sees them and whatever they give its own login. Retriever does not collect payer bank or card login credentials in this gateway flow. Separately submitted payment evidence can contain financial details described in our Privacy Policy.
Where. Nepal.
- 11
Khalti
What they do. Payment gateway. When Retriever offers it, a shop can connect its own Khalti merchant account so customers can pay an order with Khalti.
What reaches them. The amount, a payment id we issue, a generic order description and the address to return to. A shopper's browser is sent to Khalti, so Khalti also sees them and whatever they give its own login. Retriever does not collect the payer's Khalti login.
Where. Nepal.
- 12
Google, for Continue with Google
What they do. Sign in a shop owner or staff member who chooses Continue with Google.
What reaches them. Google learns that the person signed in to Retriever. Google sends Retriever that account's email address, name and profile picture link.
Where. Worldwide.
- 13
Apple, for Sign in with Apple
What they do. Sign in a shop owner who chooses Sign in with Apple in the iPhone app.
What reaches them. Apple learns that the person signed in to Retriever, and sends Retriever an email address (which may be an Apple relay address) and, the first time, a name. When that person deletes their Retriever account, Retriever tells Apple to end the sign-in link.
Where. Worldwide.
- 14
Google Fonts
What they do. Serve Space Mono, Caveat and Instrument Serif, requested by your browser on every page of retriever.com.np and every storefront.
What reaches them. The visitor's IP address, browser and the page they are on, on every page load, requested by their browser directly.
Where. Worldwide.
- 15
Google, Mozilla or Apple, for push
What they do. Deliver order and message alerts to a shopkeeper's device (a message alert names the channel only, never the customer or what they wrote). Which company is involved is decided by that person's browser, not by Retriever. A customer's phone is told separately when a card in their wallet changes; that path is the wallet entry below, not this one.
What reaches them. In a browser, the device subscription and the fact that an alert was sent; the alert content is encrypted to the device. In Retriever's phone app, Apple's or Google's notification service also carries the alert's words: for an order, "New order", the number of items, the total and delivery, pickup or table; when a customer in the Inbox asks for a person, that a customer on that channel is waiting for one. Never a customer's name.
Where. Worldwide.
- 16
Apple and Google, for wallet passes
What they do. Hold a loyalty card or an event ticket in the wallet app on a customer's phone, when that customer chooses to add one.
What reaches them. The two are not the same, and the difference is worth knowing. A Google pass is built on Google's servers, so what is on the card reaches Google: the name on it, the points balance, and for a ticket the event's name, date, venue and the ticket code itself. One thing to know about that name. If you have not told us what to call you, and you have not ordered from that shop before, the name on the card is your email address, because a card reading MEMBER and a string of letters helps nobody at a counter. So for some people it is an email address that reaches Google, not a display name. An Apple pass is a file we sign and the phone keeps, so what is written on it does not go to Apple. What Apple gets is the token used to tell a phone that its card has changed, and the fact that we sent one.
Where. Worldwide.
- 17
OpenStreetMap, for finding a place on a map
What they do. Turn an address into a pair of coordinates. A shop uses this to put a pin on its loyalty card, and an event uses it to put one on its venue, so a wallet pass can show itself when the person holding it is nearby. It runs when somebody presses the button that looks an address up, and at no other time.
What reaches them. The address text, and nothing else. Our server asks, not your browser, so they are not told which shop asked and they never see your visitors or their addresses.
Where. Europe, run by the OpenStreetMap Foundation.
- 18
Unsplash and Pexels
What they do. Host the stock photography used on Retriever's own demo shops atretriever.com.np/demo and on the pages that preview a template while a shop is being set up. A shop's own catalog uses photographs its owner uploaded, which are stored with Supabase.
What reaches them. The visitor's IP address, browser and the page they are on, when that page is one of our demo shops or a template preview.
Where. Canada and Germany, served worldwide.
- 19
GitHub and Cloudflare R2, for backups
What they do. Every three hours a GitHub Actions machine copies Retriever's database, and once a night every stored file, encrypts the copy and uploads it to Cloudflare R2, which keeps it so Retriever can be restored if Supabase is lost.
What reaches them. Everything listed under Supabase above. On the GitHub machine the copy is unencrypted only while that run lasts, then encrypted before it leaves; the machine's working files are removed when the run ends. R2 holds only encrypted copies, which neither GitHub nor Cloudflare can open, and deletes each one after 35 days. Supabase also keeps its own daily backups of the database for 7 days.
Where. Outside Nepal.
- 20
Cloudflare
What they do. Answer the name service for retriever.com.np, so a browser asking where Retriever lives gets a reply, and carry the traffic on its way to us. Separately, our server uses Cloudflare's public DNS service to check a shop's own domain when the shop connects it or sets up company email.
What reaches them. The visitor's IP address and the address being looked up. This happens before any page loads, for every visitor, and it is unavoidable for any site on the internet: somebody has to answer that question. For a domain check, only the shop's domain name.
Where. Worldwide, from whichever of their locations is nearest the visitor.