Subprocessors and data locations
These are the companies that process personal data on behalf of KarbonZ, what each one does, which data it receives, and where it processes it. Each one acts only on our instructions. When an account is deleted, we ask each of them to delete their copy too.
Version 1.1, effective
| Company | What it does | Data it receives | Where |
|---|---|---|---|
| SmartPing | Sends sign-in codes by SMS | Mobile number, the code | India |
| Google (Gmail) | Sends service emails and email reminders | Email address, name, message content | United States and other Google locations |
| Meta Platforms (WhatsApp Business) | Sends WhatsApp reminders you opt into | Mobile number, name | United States and other Meta locations |
| OpenRouter and the model provider it routes to | Reads text from uploaded ID cards and bills, and writes footprint insights | The uploaded image; for insights, your city, household and footprint figures without your name or number | United States |
| KwikAPI | Fetches your bills from the Bharat Bill Payment System when you link a biller | Consumer or account number, biller | India |
| Supabase | Hosts the KarbonZ database and stores uploaded ID-card and bill photos (in a private store, reachable only through short-lived links) | All the data above | India (Mumbai) |
| Vercel | Runs the KarbonZ app and API, and serves the website | All the data above, while it is being processed | India (Mumbai) for the API; the public website is served from Vercel’s global network |