| Company | What it does for us | Data it receives | Where (as far as we know) |
|---|---|---|---|
| Google (Firebase and Google Cloud) | Database (Firestore), sign-in (Authentication), server functions (Cloud Functions), file storage (Cloud Storage), Cloud Run (voice service), web hosting | All workspace data described in the app privacy policy, including photos and documents | Cloud Functions and Cloud Storage: us-central1 (Iowa, USA) at the time of writing. Firebase Authentication: United States. Firestore database: to be confirmed. Voice service on Cloud Run: to be confirmed. |
| Google (Google Workspace): Sheets, Drive, Apps Script, Gmail | Spreadsheet and document storage and reports for some workspaces (currently Stemzo’s own), the enquiry sheet and script, and email (sign-in codes, notifications) | Employee names, roles and emails; attendance, payroll and approval records for workspaces that use Sheets; enquiry details; the email content | Google-managed. We cannot choose the country. |
| Google LLC (Google Analytics 4) | Website visit statistics for stemzo.ai and stemzo.in. Used only after the visitor presses “Accept analytics”; nothing is sent to it before. Not used in the apps or the dashboard. Google Signals and advertising features are off. | Page address and title, time, browser and device type, referrer, a random cookie identifier and a rough location from the IP address (GA4 does not log or store IP addresses). Kept for 2 months, then only totals remain. No enquiry details. | Google-managed; servers may be in the United States. We cannot choose the country. |
| Google (Google Fonts) | Supplies the typefaces of the web dashboard (login.stemzo.ai and app.stemzo.in). Not used on this website or the apps | The address of your browser and the page request, when you open the dashboard | Google-managed. We cannot choose the country. |
| Expo | Delivers push notifications to the Android app (they then pass through Google’s own push service to the phone) | Push token, platform, and the title and text of each notification (which can include a person’s name or a request subject) | Provider-hosted; location not confirmed. |
| Plivo | Telephony for the Founder’s voice assistant | The Founder’s phone number and the call audio | Provider-hosted; location not confirmed. |
| Google (Gemini) | AI for the Founder’s voice assistant; also reads a team description if an owner types one when setting up a workspace | Live call audio (Founder only); the text of the team description, which may contain colleagues’ names and emails | Google-managed; location not confirmed. |
| Razorpay | Payments and subscriptions | Company name, owner name and email, subscription status | Provider-hosted; location not confirmed. |
| Cloudflare | Secure outbound tunnel between a company’s Tally accounting software and Stemzo, only for companies that connect Tally | Accounting records pulled from Tally (customer names, addresses and amounts) | Provider-hosted; location not confirmed. |
How these companies are used. Each is used under its own written terms of service, and we remain responsible to the Company for what each does with workspace data. We have a register of every sub-processor (what it receives, where it stores data, its breach-notice time and how it deletes data). Reading each company’s own terms against that register is still in progress, so where we say “not confirmed” we mean it. We review the register at least once a year; the next review is due on 5 October 2027. A company may ask us for the register entry for any sub-processor.
Not listed because they hold no personal data: our source-code hosting and app-build tools. If that changes we will add them.
Transfers outside India. Some of these companies run servers outside India, including Google’s us-central1 region in the United States. As we read the law, Indian law currently permits this and the Government has restricted no country at the time of writing; we will follow any restriction that is notified. Logs generated in those regions may therefore not be stored in India.
Questions and complaints
Write to the Privacy and Grievance Desk (Grievance Officer: Yashvardhan Maiya, phone +91-7797100055) at customer@stemzo.ai, or by post to Stemzo India Private Limited, 40/27, Mangturam Compound, Siliguri - 734005, West Bengal, India. See your rights for timelines and how to complain to the Data Protection Board of India.
Version 3.3, effective 6 October 2026, last reviewed 6 October 2026. It replaces version 3.2 of 6 October 2026; the list of sub-processors is unchanged and the version moves with the privacy policies. Version 3.2 replaced version 3.1 of 5 October 2026 and added Google Analytics (Google LLC), used on the stemzo.ai and stemzo.in websites only after a visitor accepts analytics. Version 3.1 only added the Corporate Identity Number next to the registered office. Version 3.0 replaced version 1.0 of 4 October 2026 and added the contract position, the review date and the notice period.