Subprocessors
We partner with a small number of trusted providers to deliver Calmo. Each provider is evaluated for privacy, security, and data handling practices.
Overview
Calmo uses subprocessors solely to provide, maintain, secure, and improve the Service for users in the United States, European Union, and other supported regions. We do not sell personal data.
This page lists our current subprocessors. We review this list regularly and aim to notify users before material changes that affect how personal data is processed.
Current Subprocessors
| Subprocessor | Location | Purpose | Data Processed | Key Protections |
|---|---|---|---|---|
| Groq, Inc. | United States | AI inference for fast classification and reply assistance | Email metadata and limited content excerpts when AI features are enabled | DPA, SCCs where applicable, no model training on customer data |
| Google LLC (Gemini) | United States | AI processing for prioritization and summarization | Email metadata and content excerpts needed for enabled AI features | DPA, transfer safeguards, encryption in transit and at rest |
| Anthropic, PBC | United States | AI processing for tone-preserving reply suggestions | Email metadata and content excerpts needed for reply assistance | DPA, no model training on customer data, enterprise privacy terms |
| Amazon Web Services, Inc. | United States; EU regions available | Cloud infrastructure, storage, compute, and serverless services | Account data, service data, preferences, metadata, and processed results | DPA, SCCs, encryption, ISO 27001, SOC 2 Type II |
| Supabase, Inc. | United States; EU regions available | Database, authentication-adjacent backend services, and API infrastructure | Waitlist records, account-related records, settings, and application metadata | DPA, encryption, access controls, SOC 2 Type II |
| Stripe, Inc. | United States and Ireland | Payment processing and subscription management | Name, email address, billing details, and payment method tokens | PCI DSS Level 1, DPA, SCCs, strong encryption |
| PostHog, Inc. | United States; EU hosting available | Product analytics and feature improvement | Usage events and feature interactions; no email content | DPA, IP anonymization, EU data option, privacy-first configuration |
Google and Microsoft may also act as independent controllers for Gmail, Google Workspace, Outlook, and Microsoft 365 accounts. Calmo only accesses email data that a user explicitly authorizes through OAuth.
AI Processing and Model Training Policy
Customer email data is not used to train AI models.
Our AI providers are expected to process customer data only for the enabled feature and are restricted from using personal data, including email content, to train or improve foundation models.
AI built for your inbox, not for training on your private communications.
Data Residency for EEA Users
Users in the European Economic Area can request that personal data be processed and stored primarily within the European Union where supported by the relevant plan and infrastructure configuration.
- EU-region hosting and storage options where available
- EU-region database options for eligible workloads
- EU-based handling for data subject requests where required
Contact our Privacy Team to discuss EU-only processing needs.
Our Commitments to You
Updates and Contact
This Subprocessors page was last updated on May 10, 2026. We update it when we add, remove, or materially change how we use a subprocessor.
For questions about subprocessors, data subject rights, or data processing terms, contact our Privacy Team:
For the complete picture of how we handle personal data, read our Privacy Policy and Terms of Use.
We share only what is needed to provide the requested service.
Vendors are reviewed for security, privacy, and operational maturity.
We keep this page current as our processing stack evolves.