Upmark Labs
Search products Talk to an expert

Legal

Subprocessors

Version 1.2. Effective October 22, 2026.

This page lists the outside companies we use to run our website and our own business that may handle personal data. For each one it shows what it does, what data it handles and where. The AI model, telephony, WhatsApp and software providers used inside the systems we build for you are not on this list. You sign up for those providers in your own accounts, and they work for you, not for us. We update this page at least 14 days before a new subprocessor starts, and you can ask to be told by email.

1. Who we are

This website is operated by UPMARK, a sole proprietorship owned by Amit Govil, trading as Upmark Labs, 3/3 B, Saket Nagar, Bhopal, Madhya Pradesh 462024, India (“we”, “us”, “our”). Our full business details are on the Company details page.

In this document, “you” means the business that orders from us or uses our website, and the person acting for that business.

2. What this page covers

We sell fixed-scope AI systems (“products”) to businesses. To run our website, take payments, send order emails and host our data, we rely on a small number of outside companies. Some of them handle personal data for us. This page names those companies.

This page covers:

  • the subprocessors we use today (section 4);
  • the providers that are not our subprocessors, because you contract with them directly (section 5);
  • how we tell you about changes to this list (section 7).

This page should be read with our Privacy Policy and our Data Processing Addendum. If this page and the Data Processing Addendum conflict, the Data Processing Addendum applies.

3. Key terms

  • Personal data means any information about an identified or identifiable person, such as a name, email address, phone number or IP address.
  • Controller means the party that decides why and how personal data is used. We are the controller for website, account, order and request data.
  • Processor means a party that handles personal data on behalf of a controller and on its instructions. We act as your processor when, to deliver your order, we access information you supply or systems you connect that contain personal data of your customers or staff.
  • Subprocessor means an outside company we engage that handles personal data for us, either as part of running our own business or as part of the services we provide to you. On this page we use the word for every outside company listed in section 4, whether the data involved is data we control or data we process for you.
  • Customer data means the information, files and system access you give us to deliver your order, including any personal data in it.
  • Client build means the AI system we build and set up for you under an order. A client build runs in your own accounts with your own providers.
  • Scope Card means the description on each product page of what is included in that product. The Scope Card in force when you buy is the scope of your order.

4. Our current subprocessors

The table below lists every subprocessor we use today.

Subprocessor Purpose Data involved Location
Contabo GmbH Hosting for our website and its database All data stored on our website: account and order details, request form details, agreement records with time and IP address, and information and files you upload through the website Germany (EU)
PayPal Processing card and PayPal payments at checkout, once this payment option is enabled Name, email address, billing address, order amount and order reference. PayPal collects card or PayPal account details directly. We never see or store full card details. Global
Our transactional email provider Delivering the emails our website sends, such as order emails, intake reminders and request confirmations Recipient name and email address, and the content of the email, which can include order details Contact hello@upmarklabs.com for the current provider and location
Google (Google Ireland Limited for the UK and EU, Google LLC elsewhere) Website analytics with Google Analytics, only for visitors who accept analytics cookies Pages viewed, device and browser type, approximate location, how the visitor arrived, and form and order events with the order number and value. No names or email addresses. IP addresses are not stored. Global, including the United States
Banks we use for bank transfers Receiving payments, and sending refunds, when you pay by bank transfer on request Name of the paying business or person, paying account details, amount and payment reference Where each bank operates

4.1 Hosting: Contabo GmbH

Contabo GmbH hosts our website and its database on servers in Germany, in the European Union. Everything the website stores is held on these servers. This includes your account, your orders, the agreements you accepted at checkout and the forms you send us.

4.2 Payments: PayPal

We are adding PayPal to our checkout to process card and PayPal payments. PayPal will act as a subprocessor from the date that payment option goes live. When you pay this way, you enter your card or PayPal details with PayPal, not with us. We never see or store full card details. PayPal processes payment data under its own terms and privacy notice.

4.3 Transactional email

Our website sends emails about your order and your requests. These include order emails, intake reminders and confirmations of Custom AI and Talk to an expert requests. Our transactional email provider delivers these emails. It handles the recipient’s name and email address and the content of each email.

4.4 Banks for bank transfers

Bank transfer is available on request only. If you choose it, we email you an invoice with our bank details. The banks involved in the transfer handle the payment details needed to move the money, and the same applies to any refund we send by bank transfer. Your order starts when the funds clear.

4.5 Website analytics: Google

If a visitor accepts analytics cookies in our cookie banner, Google Analytics measures how our website is used. Google processes this data for us under the Google Ads Data Processing Terms, which include the European Commission’s Standard Contractual Clauses. Google signals and advertising features are turned off. Visitors who reject or make no choice are not measured. Our Cookie Policy lists the cookies involved.

5. Providers that are not our subprocessors

Most of what we build runs on third-party services: AI model providers, telephony providers, WhatsApp, CRMs, helpdesks, online stores and other software. These providers are not our subprocessors. This is because:

  • You contract with them. Each client build runs in your own accounts. You open those accounts, accept the provider’s terms and choose the plan.
  • They bill you directly. Running costs, such as AI model usage (including during build and testing), call minutes, WhatsApp conversation fees, hosting and software plans, are billed by those providers to your own accounts. We do not buy third-party accounts for you.
  • You control access. You give us access by inviting our team as users or by creating API keys that you control. You can limit that access and revoke it at any time. We never ask for, or send, passwords or keys by plain email.
  • We do not use our own AI accounts for your data. We do not process customer data through AI provider accounts of our own. AI model usage for your build runs in your own provider accounts.

Because these providers work for you, the terms between you and each provider govern how it handles data. You are responsible for checking that each provider you choose is suitable for your use and for any agreements you need with it. Our Data Processing Addendum covers how we handle personal data when we access these systems on your behalf.

6. How we use subprocessors

  • We use each subprocessor only for the purpose shown in section 4.
  • We use customer data only to deliver your order.
  • If we use a subcontractor to help deliver your order, we remain responsible for its work. If a subcontractor will handle personal data, we add it to this page first, as set out in section 7.
  • Our Privacy Policy explains how we handle personal data, including transfers of data to countries outside your own.

7. Changes to this list

7.1 New subprocessors

Before a new subprocessor starts handling personal data, we update this page at least 14 days before its start date. The update shows the subprocessor’s name, purpose, the data involved and its location. Where we act as your processor, we also email the address on your account at least 14 days before the start date, as set out in our Data Processing Addendum.

7.2 How to get notice by email

Anyone can also ask to be told by email when we update this page. To subscribe:

  1. Email hello@upmarklabs.com from the address that should receive notices.
  2. Use the subject line “Subscribe to subprocessor updates”.
  3. Include your business name.

We will then email you each time we add a subprocessor. To stop these emails, write to the same address and ask to unsubscribe.

7.3 Questions or concerns about a change

If you have a question or concern about a new subprocessor, email hello@upmarklabs.com before its start date. Where we act as your processor, the Data Processing Addendum governs any change that affects your customer data.

7.4 Removed subprocessors

When we stop using a subprocessor, we remove it from this page.

9. Contact us

For questions about this page or our subprocessors, email hello@upmarklabs.com. To report a security issue, email hello@upmarklabs.com. For questions about an order, email hello@upmarklabs.com.

VersionDateChange
1.2October 22, 2026Added Google for website analytics, only for visitors who accept analytics cookies.
1.1October 16, 2026Clarified that the website is operated by UPMARK, a sole proprietorship of Amit Govil.
1.0October 13, 2026First published version.
Staging copy for testing. Not the live site; payments are in PayPal sandbox and every email goes to the team.