Warm'd LLC engages the third parties below to process personal data on behalf of our customers. This list is maintained under Section 4 of the Data Processing Addendum and Article 28(2) of the GDPR.
1. Current subprocessors
| Vendor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Hosting of the website and web application | Web requests, IP addresses, account session data in transit | United States |
| Railway Corporation | Hosting of the application servers and background workers | All Customer Data in transit and in processing | United States |
| Neon, Inc. (a Databricks company) | Managed PostgreSQL database | All Customer Data at rest, including waitlist sign-ups and consent records | United States |
| Upstash, Inc. | Managed Redis for job queues and rate limiting | Job payloads and identifiers, IP-derived rate-limit counters | United States |
| Twilio Inc. | SMS delivery, phone numbers, A2P 10DLC registration | Lead phone numbers, message content, delivery metadata | United States |
| Anthropic PBC | Large language model powering agent conversation and extraction | Conversation content, knowledge-base passages, lead context | United States |
| OpenAI, L.L.C. | Text embeddings for knowledge-base retrieval | Knowledge-base text, retrieval queries | United States |
| Stripe, Inc. | Subscription billing and payment processing | Customer billing contact and payment details | United States |
| Clerk, Inc. | Authentication and user identity | Customer user email, name, authentication metadata | United States |
| Resend | Transactional and campaign email delivery | Recipient email addresses, message content | United States |
| Google LLC (optional) | Calendar availability and event creation | Calendar free/busy data, appointment details | United States |
Vendors marked (optional) are engaged only where a customer enables the corresponding feature. A customer who never connects a calendar has no data processed by the vendor serving it.
2. Integrations you connect yourself
Separately from the list above, a customer may connect their own third-party accounts: CRMs, calendars, lead sources, and automation platforms. When you connect one, you instruct us to exchange data with it. Those services act under their own agreements with you and are not our subprocessors; we are not responsible for how they handle data once it reaches them.
3. Notice of changes
We give at least 30 days’ notice before adding or replacing a subprocessor. To receive that notice by email, write to admin@warmd.ai and ask to be added to the subprocessor notification list. Customers may object on reasonable data-protection grounds under Section 4 of the DPA.