Subprocessors
The third parties that process personal data on our behalf, what they do, and where they do it.
This page lists the third parties that process personal data on behalf of HDC Brands LLC d/b/a Carbon Grey Labs. It is referenced by our Privacy Policy, our AI Policy and our Data Processing Agreement with Studio clients.
Each subprocessor is engaged under a written contract that imposes data-protection obligations no less protective than those we owe, in line with Article 28(4) GDPR.
Website — carbongreylabs.com
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Vercel Inc. | Hosting, content delivery, TLS termination | IP address, request metadata (technical logs) | USA, global edge network |
That is the complete list for this website. The Site makes no other third-party requests — see Cookies Policy.
Corporate and business operations
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| GitHub, Inc. (Microsoft) | Source-code hosting for the website | No personal data by design | USA |
| Email provider — to confirm | Business email and correspondence | Name, email, message content | to confirm |
| CRM — to confirm | Inquiry and engagement tracking | Name, email, company, correspondence | to confirm |
Products — VinPilot, HomiPilot, BoatPilot, PilotMarket, BidderPilot
Each product maintains its own subprocessor list within that product, because each has a different set. The categories common to them are below. The named providers must be completed before this page is published.
| Category | Purpose | Data | Status |
|---|---|---|---|
| Foundation-model providers | Image enhancement, listing-copy generation, report drafting | Customer-uploaded content submitted for processing | to confirm |
| Object storage | Storing uploaded and generated media | Uploaded photographs, generated imagery | to confirm |
| Payment processor | Taking payment | Name, email, billing details, payment token | to confirm |
| Transactional email | Receipts, notifications | Name, email | to confirm |
| Error and performance monitoring | Diagnosing faults | IP address, device metadata, stack traces | to confirm |
| External data sources | Vehicle history, public records, market comparables | Asset identifiers (VIN, address) | to confirm |
All model providers are engaged on commercial terms that prohibit training on data submitted through their APIs and limit retention to what is required to return a result and satisfy their own abuse-monitoring obligations. See AI Policy Section 3.
International transfers
Subprocessors located outside the EEA or UK receive personal data under the European Commission’s Standard Contractual Clauses, and the UK International Data Transfer Addendum where the UK GDPR applies.
Changes
We will post new or replacement subprocessors here at least 30 days before they begin processing personal data. Studio clients under our Data Processing Agreement may subscribe to notice of changes and may object on reasonable data-protection grounds within that period, as set out in that agreement.
To subscribe to change notices, email privacy@carbongreylabs.com.
Entries marked “to confirm” are placeholders. This page must not be published with placeholders remaining — an incomplete subprocessor list is worse than none, because it represents completeness we have not verified.