Authorized Subprocessors Register
The third-party providers Clepto.in uses to process personal data on behalf of clients. This is the Subprocessor Site referred to in Section 7 and Annex 5 of our Data Processing Addendum.
| Subprocessor | Category | Processing performed | Company location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting and network | DNS, CDN, DDoS mitigation, web application firewall and edge routing | United States (global edge network) |
| Supabase, Inc. | Database | Managed PostgreSQL hosting, authentication, row-level security and storage | United States (region chosen per project) |
| OpenAI | AI | Language model inference and AI document and workflow processing via API | United States |
| Anthropic, PBC | AI | Language model inference and AI document and workflow processing via API | United States |
| Google (Gemini API) | AI | Language model inference via API | United States |
| Mistral AI | AI | Language model inference via API | France (EU) |
| Perplexity AI | AI | AI search and retrieval via API | United States |
| n8n GmbH | Automation | Workflow automation, webhook routing and orchestration | Germany (EU) |
| Resend, Inc. | Transactional email delivery | United States | |
| Google Workspace | Email and storage | Business email (Gmail) and document storage (Drive) | United States |
| Retell AI | Voice | AI voice agent orchestration | United States |
| ElevenLabs | Voice | Speech synthesis and voice generation | United States |
| WATI | Messaging | WhatsApp Business API messaging | Hong Kong |
| Zoho Corporation | CRM | Customer relationship management, lead and pipeline tracking | India |
Where a provider lets us choose where data is stored, we use the region the client requires or the one closest to its users. Each subprocessor is bound by written data protection terms no less protective than our Data Processing Addendum, and we prohibit AI providers from using personal data sent through our accounts to train their models. For transfers out of the EEA, UK or Switzerland we rely on the Standard Contractual Clauses (DPA Annex 2). Certifications are each provider's own; check the provider's website for current details.
Website-only tools
Google Analytics 4 (visitor statistics) and Web3Forms (backup delivery of contact-form enquiries) are used only on clepto.in and never receive client data. See our Privacy Policy and Cookie Policy.
Subprocessor change notifications
We notify all clients at least thirty (30) days before engaging a new subprocessor, by updating this page and emailing each client's designated contact. In an emergency, such as a provider shutting down suddenly or suffering a critical security or availability failure, we give notice as soon as reasonably practicable. Clients may object on reasonable data protection grounds within fifteen (15) days of the notice by emailing privacy@clepto.in, and we will work with them in good faith to resolve the objection, as set out in Section 7(d) of the DPA.