- Document owner
- Carno AI
- Version
- 1.1
- Effective date
- 2 October 2026
- Review cycle
- At least annually and on material change
01Purpose
This register identifies subprocessors Carno AI has approved for use where Carno AI processes Personal Data on behalf of a client. It supports transparency, vendor governance and Carno AI's contractual obligations as a processor under applicable UK data-protection law.
Scope. This is not a list of every technology used within a client automation environment. A provider belongs in this register where Carno AI may cause that provider to process client Personal Data as part of a client service.
Where a provider is contracted, owned or controlled directly by the client, that provider ordinarily forms part of the client's own processing environment and is not treated as a Carno AI subprocessor solely because Carno builds, configures or maintains workflows within that environment.
A provider becomes relevant to this register where Carno independently selects, contracts with or introduces that provider into the processing chain for client Personal Data.
02Operating principles
03Approved Carno-appointed subprocessors
Inclusion below means a provider has been approved for use where required. It does not mean the provider processes data for every client or every workflow.
Hostinger International Ltd.
Approved- Purpose / when used
- Hosting infrastructure for Carno-controlled automation, audit, preprocessing and other approved client-data workflows. Not normally used to host a client's ongoing production automation where that system is deployed within client-controlled infrastructure.
- Data potentially processed
- Workflow-specific client Personal Data passing through Carno-controlled services, such as names, contact details, enquiry content, property information, CRM notes and workflow metadata.
- Location / transfers
- Primary Carno VPS may be hosted in the United Kingdom. International processing may occur through Hostinger's underlying subprocessors where applicable.
- Safeguards
- Hostinger DPA and applicable transfer provisions. Carno remains responsible for securing its own VPS configuration.
Airtable (Formagrid Inc.)
Approved with controls- Purpose / when used
- Structured database/storage used in approved Carno-controlled workflows, including CRM eligibility/audit processing, workflow state and operational records where applicable.
- Data potentially processed
- Minimum necessary fields such as contact name, business email, property/enquiry information, original enquiry date, CRM notes, eligibility data, conversation context and workflow status.
- Location / transfers
- Processing locations depend on Airtable's service architecture and subprocessors and may involve international transfers.
- Safeguards
- Approved with controls where Airtable is used through a Carno-controlled workspace/base. Airtable DPA and applicable transfer safeguards should apply.
OpenAI
Approved with controls- Purpose / when used
- AI-assisted classification, extraction, summarisation and other approved processing where Carno provides the OpenAI API account or otherwise appoints OpenAI as part of the processing chain.
- Data potentially processed
- Minimum necessary client text or fields required for the specific AI operation. Unnecessary identifiers and full records should not be sent.
- Location / transfers
- Processing may occur in the UK and internationally depending on OpenAI infrastructure and subprocessors.
- Safeguards
- Use business/API services under applicable DPA and transfer terms. Apply data minimisation and do not intentionally enable optional data-sharing or training for client-data projects.
04Client-controlled technology providers
Many Carno AI systems are deployed within technology accounts owned or controlled directly by the client. These services may process Personal Data as part of the overall automation but are not automatically subprocessors appointed by Carno AI.
Carno may be granted authorised access to configure, integrate, monitor or maintain these systems without becoming the party that appointed the underlying provider. The client's contractual relationship and data-processing arrangements with those providers continue to apply.
05Carno-controlled preliminary processing
Certain services may require preliminary processing within Carno-controlled systems before deployment or operation within the client's own environment. For example, Carno may process an approved CRM export to assess campaign eligibility, structure records, create workflow context or perform other agreed preprocessing.
Where this occurs, the specific providers used by Carno for that processing are treated as subprocessors where applicable. This may include Carno-controlled infrastructure hosted by Hostinger, Airtable and approved AI/API providers such as OpenAI.
Only the information reasonably necessary for the agreed processing should be transferred, and the relevant processing, retention and deletion arrangements are governed by the client DPA and project documentation.
06Approval conditions
Inclusion in this register means that a provider has been approved for use where required; it does not mean that the provider processes data for every client or every workflow.
The actual subprocessors applicable to an engagement depend on the architecture used for that client's service. Carno documents or discloses the relevant subprocessors through the applicable contractual and onboarding process.
Where equivalent technology is contracted directly by the client, it may fall outside Carno's subprocessor chain even though Carno configures or works with that technology.
Where OpenAI or another AI/API provider is used by Carno, prompt context should be minimised and personal identifiers should be excluded where the AI task does not require them. Processing involving identity documents, bank details, special-category data, high-impact profiling or significant automated decisions should be escalated for a specific privacy and security assessment before production deployment.
07Governance & change management
Subprocessor onboarding
Before a new provider is permitted to process client Personal Data on Carno's behalf, Carno should assess the provider's role, purpose, data categories, security posture, contractual data-processing terms, retention, processing locations, international-transfer safeguards and underlying subprocessors where relevant.
Client authorisation and notification
Carno AI's client Data Processing Agreement should define how subprocessor authorisation works. Where general written authorisation is used, Carno should provide appropriate notice of intended additions or replacements and allow the client an opportunity to object in accordance with the agreed terms.
Review triggers
This register should be reviewed at least annually and sooner where there is a material change to a provider's DPA, retention practices, processing locations, subprocessor list, security posture, Carno AI architecture or the categories of client data being processed. A review should also occur where responsibility for a provider changes, for example where a service moves from a Carno-controlled account to a client-controlled account, or vice versa.
Removal
A provider should be removed from approved Carno use for client Personal Data where Carno no longer uses the service, cannot maintain appropriate contractual or security safeguards, or determines that the provider is no longer appropriate for the intended processing.
08Official provider references
Document note
This register is an operational compliance document and does not constitute legal advice. It should be used alongside Carno AI's client DPA, information-security controls, retention/deletion procedures and system-specific risk assessments. Material or higher-risk client processing should be reviewed against the exact facts and current applicable requirements.