Skode Technologies Private Limited (CIN: U62011KL2026PTC102406) ("SkedX," "we," "us," or "our") engages the following third-party sub-processors to assist in providing our Services. Each sub-processor is bound by a data processing agreement that requires them to process personal data in accordance with applicable data protection laws and our Data Processing Agreement.
This page is maintained in accordance with our obligation to provide transparency about the third parties that process data on behalf of our customers. We update this list when we add or remove sub-processors.
1Cloud infrastructure and hosting
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, database hosting, file storage (S3), transactional backups | All customer data, application data, file uploads | India — Hyderabad (ap-south-2) for application servers, databases, newer files, backups and call recordings; Mumbai (ap-south-1) for older stored files, backup copies and email sending (Amazon SES). We do not currently offer EU-based hosting. See Where your data is stored. |
| Cloudflare | CDN, DDoS protection, DNS, web application firewall | IP addresses, request metadata, cached content | Global (edge network) |
2AI and machine learning
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| OpenAI | Voice transcription (Whisper API), AI-powered CRM features (GPT-4o-mini), natural language processing | Voice recordings (transient, not stored), call recordings for transcription (SkedX Call, where enabled), CRM text data for analysis, user prompts | United States |
| Anthropic | AI connector (Claude API) — CRM analysis, content generation, conversation intelligence | CRM text data from user-selected modules, user prompts | United States |
| Google LLC (Gemini API) | AI features in CRM, Flow and Automate (drafting replies, summaries, classification, workflow AI steps) and the website assistant | Text sent to the AI feature the user invokes: message and record content, user prompts | United States |
Note: OpenAI and Anthropic each process data under zero-data-retention API agreements; Google processes Gemini API requests under its paid-service terms, which do not use the data to train its models. Data sent to these providers is not used for model training and is not retained after processing is complete. The AI Connector is opt-in at the workspace level and only processes data from modules explicitly selected by the connected user. See our AI Connector Terms for details.
2ATelecommunications (SkedX Call)
| Sub-Processor | Purpose | Data Involved | Location |
|---|---|---|---|
| Plivo (Plivo Inc. / Plivo Communications India Pvt. Ltd.) | Telecommunications carrier for SkedX Call — call origination, termination, number provisioning, regulatory compliance filings | Telephone numbers, call metadata, call audio in transit, customer verification (KYC) documents submitted for compliance filings | India, United States |
3Payment processing
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Razorpay | Payment processing, subscription billing and autopay for all customers — UPI/NetBanking and cards in India, international cards in US dollars | Billing name, email, card brand, last-4 digits and expiry, UPI handle, billing address, transaction history | India |
Note: Razorpay is PCI DSS Level 1 certified. Full card numbers are processed and stored directly by the gateway and never touch SkedX servers — we retain only the card brand, last-4 digits, and expiry returned by the gateway for display.
4Email and communication
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Amazon Web Services (Amazon SES) | Transactional and product email (sign-in codes, password resets, invoices, notifications) and the email campaigns customers send from SkedX | Recipient email addresses, email content, delivery and bounce metadata | India (Mumbai, ap-south-1) |
| Zoho Mail | Replies to enquiries sent through the skode.ai website ([email protected]) | Name, email address and message of people who contact us through the website | India |
| Twilio | SMS messaging, voice calls, phone-number provisioning, call recording (only when the customer connects Twilio as their telephony provider) | Caller and recipient phone numbers, SMS content, call audio, call metadata | United States |
| Aircall | Cloud telephony, voice calls, call recording (only when the customer connects Aircall as their telephony provider) | Caller and recipient phone numbers, call audio, call metadata | France / European Union and United States |
| RingCentral | Cloud telephony, voice calls, call recording (only when the customer connects RingCentral as their telephony provider) | Caller and recipient phone numbers, call audio, call metadata | United States (with regional data centres) |
| Exotel | Cloud telephony, voice calls, call recording — primarily for India customers (only when the customer connects Exotel as their telephony provider) | Caller and recipient phone numbers, call audio, call metadata | India |
Note: Telephony sub-processors listed above are only engaged when a customer explicitly connects the corresponding provider in their workspace settings. SkedX does not route calls through any of these providers by default.
5Messaging platforms
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Meta (WhatsApp Business API) | WhatsApp messaging, template messages, media delivery | Phone numbers, message content, media files, delivery status | United States, EU |
| Gupshup | WhatsApp Business Solution Provider for SkedX Flow — WhatsApp account onboarding and message delivery for workspaces connected through it | Phone numbers, message content, media files, delivery status | India |
| Meta (Instagram Messaging API) | Instagram Direct messaging, automated responses | Instagram user IDs, message content, media files | United States |
| Meta (Facebook Messenger API) | Facebook Page messaging, comment management | Page-scoped user IDs, message content, media files, engagement data | United States |
6Analytics and monitoring
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Analytics | Website analytics, traffic analysis, user behavior tracking | IP addresses (anonymized), page views, session data, device information | United States |
| PostHog | Product analytics and application logs | User interactions, feature usage data, application log events | United States |
7Authentication and security
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google LLC (OAuth 2.0, Calendar, Gmail) | Optional “Sign in with Google”, and — if the user enables them — Google Calendar event sync and Gmail email tracking. Also applies to future Gemini Extension / Google Agentspace connector sessions initiated by the user. | Email address, name, profile picture, and (only for scopes the user explicitly authorises) calendar events and email metadata. Handled under the Google API Services User Data Policy Limited Use terms. | United States |
| Microsoft (OAuth 2.0) | Optional “Sign in with Microsoft” social login (only when the user chooses this sign-in method) | Email address, name, profile picture (as authorized by the user) | United States (global Microsoft Entra infrastructure) |
8Customer support
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Intercom | In-app messaging, customer support chat, help center | Name, email, conversation content, user attributes | United States |
8ABrowser extension
The SkedX Flow Chrome browser extension introduces no new sub-processors beyond those listed above. The extension is a client of the SkedX Flow backend and uses only the same hosting, infrastructure, and ancillary processors already documented on this page. No additional vendors receive data because you install the extension. The extension also does not transmit any data to Skode-operated systems other than your own SkedX Flow backend (and, if you opt in, anonymous usage telemetry).
9Notification of changes
We will notify customers of any changes to this sub-processor list at least 30 days before engaging a new sub-processor or changing the role of an existing one. Notifications are sent via email to the account administrator.
If you object to a new sub-processor, you may notify us within 30 days of the notification. We will work with you to address your concerns. If we cannot resolve the objection, you may terminate the affected Services in accordance with our Data Processing Agreement.
10Data processing safeguards
All sub-processors are required to:
- Enter into a data processing agreement with SkedX that imposes data protection obligations no less protective than those in our DPA.
- Implement appropriate technical and organizational security measures.
- Process personal data only as instructed by SkedX and only for the purposes described above.
- Delete or return personal data upon termination of the sub-processing agreement.
- Submit to audits and inspections as required by applicable data protection laws.
11International data transfers
Where sub-processors are located outside the European Economic Area (EEA) or other jurisdictions with data transfer restrictions, we ensure appropriate transfer mechanisms are in place, including EU Standard Contractual Clauses (SCCs), the UK Addendum, and the safeguards set out for Switzerland, New Zealand, the UAE and Saudi Arabia in Section 7 of our Data Processing Agreement.
12Contact us
For questions about our sub-processors or data processing practices:
- Email: [email protected]
- DPA: View our Data Processing Agreement
- Privacy Policy: View our Privacy Policy
Write to [email protected]. A person answers.