Sub-processors

Owned and provided by AIO Infinity Private Limited (parent company) Website: https://www.infiq.in Effective / Last Updated: 13 October 2026

1. Introduction

InfiQ is a WhatsApp Business API (CPaaS) platform owned and provided by its parent company, AIO Infinity Private Limited (CIN U62013MP2025PTC074108; GSTIN 23ABBCA9125H1ZX), 54, Old Subhash Nagar, Bhopal – 462023, Madhya Pradesh, India ("InfiQ", "we", "us", "our"). This page identifies the Sub-processors we engage to deliver, operate, secure, and support the InfiQ platform (the "Service").

1.1 What is a Sub-processor?

A Sub-processor is a third party (including any InfiQ affiliate) that we engage to Process Customer Data on our behalf in order to deliver, operate, secure, and support the Service. When you (the Customer, acting as Controller / Data Fiduciary) use InfiQ, InfiQ acts as your Processor / Data Processor, and the Sub-processors listed below act as our sub-processors.

Each Sub-processor Processes Customer Data only to the extent needed to perform the specific service it provides to InfiQ, and under a written contract that imposes data-protection obligations equivalent in substance to those in our Data Processing Agreement (DPA) (https://www.infiq.in/dpa). InfiQ remains fully liable to the Customer for the performance of each Sub-processor's data-protection obligations.

Capitalised terms used but not defined here have the meanings given to them in the InfiQ DPA and the shared definitions of the InfiQ legal suite.

1.2 Why we publish this list

We publish this list for transparency and to satisfy our commitments under the DPA and Applicable Data Protection Law (India's DPDP Act 2023, the EU/UK GDPR, and the CCPA/CPRA). It lets you assess our supply chain and exercise your objection right (Section 4).

1.3 Updates, notice, and the objection right

Under Section 6 of the DPA, you have granted InfiQ general written authorisation to engage Sub-processors. This list may be updated from time to time as our services evolve. Before a new Sub-processor begins Processing Customer Data, or before InfiQ replaces an existing one, InfiQ will:

• give you at least ten (10) days' advance notice of the material addition or replacement; and
• allow you to object on reasonable data-protection grounds within that notice period, with the remedies (including a pro-rata refund and termination of the affected Service) described in the DPA.

Subscribe to change notifications. To be notified of changes to this list, email privacy@infiq.in with the subject line "Subscribe — Sub-processor updates" and the account / domain you use with InfiQ. Where a self-service subscription option is available in the InfiQ dashboard, you may also subscribe there.

---

2. Current Sub-processors

The "Processing location" column indicates where the Sub-processor Processes or stores the data described in its row. The Sub-processors in Sections 2.1–2.3, which Process Customer Data, currently do so in India. The Sub-processors in Section 2.4 support the security and reliability of the InfiQ website and Platform and Process the limited technical data described there outside India. Where a Customer sends EU/UK or other regulated Personal Data into India, transfers are safeguarded as described in Section 3.

2.1 Cloud & Hosting

2.2 Messaging Platform

Note on WhatsApp message processing. Because the Service is built on the WhatsApp Business API, all messages you send and receive through InfiQ are necessarily Processed by Meta / WhatsApp. Meta's handling of that data is governed by the Meta Terms and Meta's own retention and security practices, which are outside InfiQ's direct control. See Section 6.5 and Section 10.5 of the DPA.

2.3 Payments

Note. Payment Sub-processors typically Process the billing contact and payment data of the Customer's own account (not End-User message content). Card data is handled by the payment provider as a PCI-DSS-compliant processor; InfiQ does not store full card numbers. Additional payment processors may be added from time to time and will be reflected on this page.

2.4 Website Security & Error Monitoring

Note on Section 2.4. These Sub-processors support the security and reliability of the InfiQ website and Platform; they are not part of the WhatsApp message path and are not used to Process WhatsApp message content or contact lists. They are listed here for transparency, and changes to them are notified under Section 1.3 in the same way as any other Sub-processor. Unlike the Sub-processors in Sections 2.1–2.3, the Processing described in this section takes place outside India — see Section 3.

2.5 Other operational services

In addition to the Sub-processors listed above, InfiQ may use additional operational Sub-processors to run the Service — for example, for email / notification delivery, analytics, additional monitoring, and customer-support tooling (the error-monitoring and bot-protection Sub-processors already engaged are named in Section 2.4). Where InfiQ engages such a Sub-processor to Process Customer Data, InfiQ will update this list and give notice of material additions in accordance with Section 1.3, so that Customers can exercise the objection right in Section 4.

---

3. Data Residency and Onward International Transfers

All InfiQ data centres are currently located in India. The cloud infrastructure providers above (AWS, Microsoft Azure, and Google Cloud) are configured to use India data-centre regions, and the WhatsApp Business API / Meta Cloud API used by the Service is localised to India. In the ordinary course, the Service does not export Customer Data out of India.

Scope of that statement. It describes the infrastructure on which the Service runs and the Customer Data InfiQ stores. It does not extend to the website-security and error-monitoring Sub-processors in Section 2.4: Sentry ingests error and diagnostic telemetry and, for visitors who have consented to analytics cookies, masked Session Replay recordings in the United States, and Cloudflare performs Turnstile verification on its global edge network. The data involved is limited to the technical and form-submission data described in those rows (error diagnostics and masked session recordings; a challenge token and the submitting visitor's IP address) and does not include WhatsApp message content or contact lists.

Where a Customer (or a Controller on whose behalf the Customer acts) sends Personal Data that is subject to the EU GDPR, the UK GDPR, or another Applicable Data Protection Law into India by using the Service, that transfer into India may be a Restricted Transfer. For such transfers, InfiQ ensures that an appropriate transfer mechanism is in place, as described in Section 7 of the DPA, including:

• the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two and, where relevant, Module Three) for transfers subject to the EU GDPR;
• the UK International Data Transfer Addendum (UK IDTA) for transfers subject to the UK GDPR;
• reliance, where applicable, on the EU–US / UK Extension / Swiss–US Data Privacy Framework for any validly self-certified Sub-processor; and
• compliance with the DPDP Act 2023 and any cross-border transfer conditions notified by the Central Government of India.

Encryption in transit (TLS 1.2 / 1.3) and at rest (AES-256, with databases encrypted to industry standards) and the other technical and organisational measures in Annex II of the DPA apply as supplementary safeguards to these transfers.

---

4. How to Object to a New Sub-processor

If we notify you of a new or replacement Sub-processor and you have a reasonable data-protection concern, you may object as follows:

1. Write to us at privacy@infiq.in within ten (10) days of the notice, with the subject line "Sub-processor objection".
2. Tell us your grounds — identify the Sub-processor and describe your specific, reasonable data-protection concern (for example, the Processing location, the security posture, or an adequacy / transfer issue).
3. We will work with you in good faith to address the concern — for example, by describing additional safeguards, offering an alternative configuration, or (where feasible) making the Service available without the objected-to Sub-processor.
4. If we cannot resolve it, you may, as your sole and exclusive remedy, terminate the affected part of the Service, and we will provide a pro-rata refund of any prepaid Subscription Fees for the unused portion of the then-current term for that affected Service, as set out in Section 6.3 of the DPA.

If you do not object within the notice period, you are deemed to have authorised the new or replacement Sub-processor. Note that Meta / WhatsApp is an essential Sub-processor (Section 2.2); an objection to Meta can, as a practical matter, only be resolved by terminating the affected Service.

---

5. Last Updated and Contact

Last updated: 13 October 2026 (Section 2.4: Sentry Session Replay now records every consented session, not a sample; Sentry data is now ingested in the United States)

For questions about this page, about our Sub-processors, or to subscribe to change notifications or lodge an objection, contact us:

Related documents: Data Processing Agreement (https://www.infiq.in/dpa) · Privacy Policy (https://www.infiq.in/privacy-policy) · Terms and Conditions (https://www.infiq.in/terms).