KaremeloLast updated: [DATE]
Karemelo uses the following providers to process Customer Personal Data on behalf of business customers where the relevant service or feature is enabled.
1. Karemelo Subprocessors
| Provider | Purpose | Data potentially processed | Processing/location information |
|---|---|---|---|
| Hetzner Online GmbH / applicable Hetzner contracting entity | Primary application infrastructure and hosting | Customer records, conversation data, account/application data, uploaded content | Karemelo's selected primary hosting region: Germany [VERIFY EXACT DATACENTRE/PRODUCT LOCATION]. Hetzner's cloud location depends on the customer-selected product region. |
| Cloudflare, Inc. / applicable affiliate | Network delivery, security, traffic protection and configured storage/network services | IP addresses, request metadata, traffic and potentially application content depending on service | Global network; localisation depends on Karemelo configuration. No EU-only claim unless regionalisation is verified. |
| OpenAI, L.L.C. / applicable OpenAI entity | AI model inference and language processing | Prompts, relevant conversation content, structured context and outputs | Processing depends on API project/configuration. OpenAI API data is not used for model training by default; default abuse-monitoring retention may be up to 30 days unless an eligible stronger control applies. |
| Retell AI, Inc. | Voice-AI, call processing, transcription and related telephony functionality | Telephone numbers, call audio, transcripts, call metadata, agent context and outputs | International/US-related processing may occur according to Retell's documentation and subprocessors. Exact Karemelo retention, storage region and DPA settings must be verified. |
| Resend / applicable contracting entity | Transactional and authorised email delivery | Email address, message content, delivery/log metadata | Resend's documented standard-plan email/log retention is 30 days and its transfer documentation covers US processing. |
| Sentry / Functional Software, Inc. or applicable entity | Error monitoring and service diagnostics | Error events, technical identifiers, request/device metadata and any content inadvertently included in captured errors | Region and Karemelo project configuration to be verified; Customer Content should be scrubbed/minimised. |
| Umami [only if third-party-hosted] | Website analytics | Website usage and technical analytics | Include only if Karemelo uses hosted Umami rather than self-hosting; exact configuration/location to be verified. |
2. Connected platforms and other recipients
The following providers may receive information but are not necessarily Karemelo subprocessors for every legal purpose:
| Provider | Role |
|---|---|
| Meta Platforms / applicable affiliate | WhatsApp Business Platform and Instagram messaging infrastructure. Meta's exact controller/processor role depends on the specific platform service and contractual arrangement. |
| Polar Software, Inc. / applicable affiliate | Merchant of record and authorised reseller for subscription transactions handled through Polar. Polar processes buyer/payment information for its transaction and legal purposes and is not treated merely as a subprocessor of private conversation content. |
| Telecommunications carriers | Calls may transit carriers used directly or through Retell. Karemelo will not name a carrier here unless its direct or indirect processing relationship and applicable disclosure have been verified. |
3. Subprocessor changes
Where a Customer has given general authorisation for subprocessors under the Karemelo DPA, Karemelo will maintain this list and provide active notice to the relevant account administrator before appointing a new material subprocessor, ordinarily at least 15 days before the new provider begins processing Customer Personal Data.
Customers may object during that period on reasonable data-protection grounds in accordance with the DPA.