Sub-processors
Effective 24 April 2026
KARG uses the following third parties to deliver the platform. We notify customer administrators by email at least 30 days before adding or replacing a sub-processor that processes personal data.
Core infrastructure
Used for every workspace.
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| Supabase Privacy | Primary PostgreSQL database, authentication, file storage | All workspace data, account credentials, uploaded documents | EU (Frankfurt) |
| Vercel Privacy | Frontend and API hosting, edge network, image optimisation | HTTP requests, IPs, request logs | EU edge regions |
| Upstash Privacy | Redis cache and QStash scheduled jobs (matching cycle) | Cached responses, idempotency keys, queued job payloads | EU (Frankfurt / Ireland) |
| Sentry Privacy | Application error and performance monitoring | Error stack traces, request metadata (scrubbed of secrets) | EU |
Messaging
Used to send and receive driver and dispatcher messages.
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| Telegram (Bot API) Privacy | Driver and dispatcher notifications, inbound messages | Driver name, chat ID, message contents you choose to send | Operated by Telegram Messenger Inc. |
| Twilio Privacy | WhatsApp messaging channel (optional, where enabled) | Driver phone numbers, message contents | United States (EU SCC in place) |
AI document extraction
Used to parse PDF road documents into structured data.
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| Google Gemini API Privacy | Structured extraction from PDF road documents (CMR, T1, invoices) | PDF page images and extracted text submitted for analysis | Google Cloud, EU SCC in place |
External integrations (only when you connect an account)
These providers receive data only because you, as a carrier, have an existing relationship with them and have authorised KARG to act on your behalf.
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| FomCo Privacy | Telematics and freight-exchange access (only if connected) | Vehicle IDs, GPS positions, load search criteria | Romania |
| TimoCom Privacy | European freight and tender exchange (only if connected) | OAuth tokens, load search and offer payloads | Germany / EU |
| HMRC (UK Government) Privacy | UK customs declarations and notifications (where the carrier opts in) | Declaration data, vehicle / driver identifiers, OAuth tokens | United Kingdom |
Notifications & objection
To subscribe to sub-processor change notifications or to object to a new sub-processor, write to privacy@karg.to. If we cannot accommodate a reasonable objection we will give you the option to terminate the affected service for a pro-rata refund of pre-paid fees.