Legal

Subprocessors

Current vendors that may process customer data to deliver the CARMA platform. Updated 2026-06-11.

AutoCity LLC (publisher of CARMA) engages the subprocessors below to deliver the platform. Each is bound by a written agreement covering confidentiality, security, and data protection. We notify customers by email of material additions or replacements before they take effect.

Vendor

Purpose

Location

Supabase / Lovable Cloud

Application database, authentication, and object storage

United States

Cloudflare

Edge hosting, DNS, DDoS protection, and CDN

Global edge / United States

Twilio

SMS, MMS, and voice messaging delivery on behalf of dealerships

United States

Resend

Transactional email delivery (account, billing, alerts)

United States

Stripe

Subscription billing and payment processing

United States

Sentry

Application error monitoring and diagnostics

United States

To receive advance notice of subprocessor changes, email legal@carmaloop.ai with subject line "Subprocessor notifications". A current Data Processing Addendum is available at /dpa.