SAM.AI by Carmaa — Legal
Subprocessors List
Third-party providers we use to process data on your behalf or to enable features you turn on.
To provide SAM.AI, we use the third-party providers below to process data on our behalf or to enable features our customers turn on. Each is engaged under data-protection terms consistent with our DPA. We will provide reasonable prior notice of new subprocessors via this page and/or email; customers may object on reasonable data-protection grounds (DPA §6).
Infrastructure & Core Platform
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, database (DynamoDB), object storage (S3), secrets (Secrets Manager + KMS), compute | All Customer Data and account data, encrypted at rest | India (Mumbai, ap-south-1) primarily |
| Razorpay | Payment processing for Subscriptions | Billing/transaction data; card/bank data handled directly by Razorpay (PCI-DSS) | India |
Communications & Notifications
| Subprocessor | Purpose | Data Processed | Notes |
|---|---|---|---|
| Email / notification provider | Transactional & notification emails | Recipient email, message content | India / global |
| Slack (internal ops notifications, if used) | Internal alerts (e.g. new lead/booking, support) | Limited operational metadata | Optional |
Customer-Enabled Integrations
These process data because the customer chooses to connect them. The customer’s relationship and terms with each provider also apply.
| Provider | Purpose | Data Processed |
|---|---|---|
| Meta Platforms (WhatsApp Business Platform) | Send/receive WhatsApp messages | Contact phone numbers, message content, WhatsApp account identifiers, access tokens |
| Google (Calendar / Sign-In) | Calendar event creation; optional Google sign-in | Calendar tokens, event details, account email |
| Publish/schedule posts | LinkedIn tokens, profile/org identifiers, post content | |
| Customer’s AI provider (e.g. Google Gemini, OpenAI, Groq) | Generate AI replies/content using the customer’s own API key | Prompts and the conversation/content needed to generate a response |
Notes
- We host primarily in India; some integrations above may process data outside India under their own terms and our transfer safeguards (see Privacy Policy §9, DPA §12).
- We will provide reasonable prior notice of new subprocessors via this page and/or email; customers may object on reasonable data-protection grounds (DPA §6).
Questions: techcarmaa@gmail.com · +91 70425 55401
Carmaa Technologies Private Limited · CIN: U45403UT2025PTC019812 · PAN: AANCC0341C · GSTIN: 05AANCC0341C1Z9
DPIIT Recognition No.: DIPP223487 · MSME (Udyam): UDYAM-UK-05-0116928
197 Tea Estate, Near Bhadri Guest House, Banjarawala, Dehradun – 248001, Uttarakhand, India
Email: techcarmaa@gmail.com · Phone: +91 70425 55401