Last updated: July 18, 2026

Subprocessors

Amorati BV (doing business as Calmo) uses the service providers below to host and operate the product, authenticate users, send email, bill subscriptions, collect payments, capture analytics, fetch public artist metadata, and handle e-signatures. They may process personal data on our instructions as part of providing the Service. Where a provider processes data outside the EEA, we rely on appropriate transfer safeguards (such as the EU–US Data Privacy Framework where applicable, and/or European Commission standard contractual clauses). This list is representative; we will update it when we add or replace a material subprocessor.

Cloudflare, Inc. (United States / global edge) — application delivery, security, and compute (Workers); relational database (D1); object storage (R2); and related edge infrastructure. Calmo runs on Cloudflare; we do not use a separate application host outside this environment.
Google LLC (United States) — OAuth sign-in when you choose "Continue with Google"; subject to Google's terms and privacy policy for that product.
Plunk (Belgium / EU-hosted) — transactional email (for example verification and workflow messages) and marketing email when recipients have opted in.
Autumn (billing layer; useautumn.com) — subscription plans, metering, entitlements, and billing orchestration on top of Stripe.
Stripe, Inc. (United States / Stripe Payments Europe, Limited for EEA customers as applicable) — card and payment processing used with Autumn at checkout and for subscription billing.
Firma / 1600 Holdings LLC (United States) — electronic signature API and related services for contract signing; see Firma's terms and privacy materials for how Firma handles signer data.
PostHog, Inc. (United States entity; Calmo uses the EU cloud deployment) — product analytics; exception capture for errors; in-app surveys; and feature flags. If we enable additional PostHog capabilities that materially change how personal data is processed (for example session replay), we will update this page.
Spotify AB (Sweden / EEA) — Spotify Web API calls to fetch public artist profile metadata (for example name, image, genres, follower counts) when a Spotify artist URL or identifier is provided in the Service. We do not use Spotify to log listening history or access private account content.

Questions: contact@calmo.ai

This page is provided for transparency. It is not legal advice; please consult qualified counsel for compliance with your obligations.