Data Processors and Sub-Processors

Last Updated: 29th January 2026

1. Introduction

This document lists all third-party service providers (“sub-processors”) that Carrott uses to process personal data. As required by GDPR Article 28 and other applicable data protection laws, we maintain transparency about who handles data on our behalf.

Data Controller:

• Company Name: Carrott LTD
• Contact: admin@carrott.io
• Data Protection Officer: admin@carrott.io

2. Categories of Data Processors

Our sub-processors fall into the following categories:

• Payment Processing
• Email Services
• SMS Services
• Mobile Wallet Services
• Cloud Infrastructure
• Storage Services
• Domain Services
• Authentication Services
• Analytics (if applicable)

3. List of Sub-Processors

3.1 Payment Processing

Purpose: Process subscription payments for Business Users, handle agency payouts via Stripe Connect, manage billing events and invoicing.

Data Transferred:

• Customer name and email
• Payment method information
• Billing address
• Subscription plan details
• Usage-based billing data

3.2 Email Services

Purpose: Deliver authentication emails (magic links, password resets), transactional notifications, subscription alerts, and marketing communications.

Data Transferred:

• Recipient email addresses
• Email content (subject, body)
• Sender information
• Delivery status and events

3.3 SMS Services

Purpose: Send OTP verification codes during customer enrollment, phone number verification.

Data Transferred:

• Recipient phone numbers (E.164 format)
• SMS message content (verification codes)
• Delivery status

3.4 Mobile Wallet Services

Purpose: Generate, distribute, and update digital loyalty cards in Apple Wallet and Google Wallet.

Data Transferred to Apple:

• Pass content (card design, text fields, barcodes)
• Device library identifiers
• Push notification tokens
• Pass serial numbers
• Authentication tokens

Data Transferred to Google:

• Loyalty object data (card content, balances)
• Class identifiers
• Object identifiers
• Callback events (saves, deletions)

3.5 Cloud Infrastructure & Database

Purpose: Host and process all application data, execute backend logic, provide real-time data synchronization.

Data Transferred:

• User account data
• Business configuration
• Customer loyalty data
• Transaction records
• All platform data

3.6 Storage Services

Purpose: Store and serve card template images, business logos, wallet pass assets, and other media files.

Data Transferred:

• Image files
• Asset metadata
• Storage keys/references

3.7 Domain & Routing Services

Purpose: Enable white-label custom domains for agencies, manage SSL certificates, route traffic.

Data Transferred:

• Domain names
• DNS records
• Virtual host configuration

3.8 Authentication Services

Purpose: Handle user authentication, session management, magic link verification.

Note: Better Auth is a library running within our Convex backend, not an external service. Authentication data is processed within our infrastructure.

3.9 Customer Support & Feedback

Purpose: Provide in-app customer support, collect user feedback, manage feature requests and bug reports.

Data Transferred:

• User name and email address
• Support ticket content and attachments
• Feature request and feedback submissions
• User interaction metadata

3.10 Location Services

Purpose: Provide address autocomplete for business location entry, validate addresses.

Data Transferred:

• Address search queries
• Selected place IDs
• Geographic coordinates

4. Data Flow Summary

User Input
    │
    ▼
┌─────────────────────────────────────────────────────┐
│                 Carrott                      │
│              (Convex Backend)                        │
│                                                      │
│  ┌─────────┐  ┌─────────┐  ┌─────────┐             │
│  │ Users   │  │Agencies │  │Customers│             │
│  └────┬────┘  └────┬────┘  └────┬────┘             │
└───────┼────────────┼────────────┼───────────────────┘
        │            │            │
        ▼            ▼            ▼
   ┌─────────────────────────────────────────────┐
   │           Third-Party Processors            │
   │                                             │
   │  ┌────────┐  ┌────────┐  ┌────────┐        │
   │  │ Stripe │  │ Resend │  │ Twilio │        │
   │  │Payment │  │ Email  │  │  SMS   │        │
   │  └────────┘  └────────┘  └────────┘        │
   │                                             │
   │  ┌────────┐  ┌────────┐  ┌────────┐        │
   │  │ Apple  │  │ Google │  │Cloud-  │        │
   │  │ Wallet │  │ Wallet │  │ flare  │        │
   │  └────────┘  └────────┘  └────────┘        │
   └─────────────────────────────────────────────┘

5. Security and Compliance

5.1 Processor Requirements

All sub-processors are required to:

• Implement appropriate technical and organizational security measures
• Process data only according to our documented instructions
• Ensure personnel are bound by confidentiality obligations
• Assist with data subject requests
• Delete or return data upon termination
• Make available information for compliance audits
• Notify us of data breaches without undue delay

5.2 Data Processing Agreements

We maintain Data Processing Agreements (DPAs) or equivalent contractual protections with all sub-processors, including:

• Standard Contractual Clauses (SCCs) for international transfers
• Security requirements and audit rights
• Sub-processor notification procedures
• Breach notification obligations

5.3 Certifications and Compliance

6. Changes to Sub-Processors

6.1 Notification

We will notify Business Users of any intended changes to sub-processors at least 30 days before the change takes effect, via:

• Email notification to account administrators
• Update to this document

6.2 Objection Process

Business Users may object to a new sub-processor by contacting us at admin@carrott.io within 14 days of notification. We will work to address concerns or provide alternatives where possible.

6.3 Change Log

7. Contact Information

For questions about our sub-processors or to request Data Processing Agreements:

Carrott LTD

• Email: admin@carrott.io
• Address: Piccadilly Business Centre, Blackett Street, Manchester, M12 6AE

This Sub-Processors list is effective as of 29th January 2026.