GDPR/PDPL — who is responsible for what?

You are the business collecting from your customers; the platform processes it to provide the service, with retention, erasure and isolation built in. The legal pages state the split plainly.