Sub-Processor Register
Last updated: 29 July 2026
This page lists the third-party service providers ("sub-processors") that Hiyan Enterprises Pvt Ltd ("we", "us") engages to process data in the course of operating the GulSuite platform. We maintain this register in the interest of transparency and to help our business customers meet their own obligations under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").
Each sub-processor is engaged under a written contract (a Data Processing Agreement or equivalent) that requires appropriate security safeguards and confidentiality, as contemplated by Section 8(2) of the DPDP Act. Where the sub-processor offers it, we additionally rely on Zero Data Retention arrangements.
1. Infrastructure & Hosting
| Sub-processor | Purpose | Data processed | Location | Safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Cloud servers hosting the Service and customer databases | All Service data | Germany (EU) | DPA; EU GDPR regime |
| Cloudflare, Inc. | Content delivery network, static asset storage, security/WAF | Application static assets; IP & edge request metadata | Global edge | DPA |
2. Artificial Intelligence
| Sub-processor | Purpose | Data processed | Location | Safeguard |
|---|---|---|---|---|
| Anthropic, PBC | Large-language-model features: Ask Gul AI, support assistance, summaries, analytics | Text prompts submitted to AI features (with personal identifiers minimised) | USA | DPA + Zero Data Retention; no model training on customer data |
| Deepgram, Inc. | Speech-to-text transcription for voice features | Audio submitted to voice features | USA | DPA; limited retention |
Our AI sub-processors are contractually prohibited from using your data to train their models. We apply data-minimisation to AI prompts, removing personal identifiers that are not required for the requested task before transmission.
3. Payments
| Sub-processor | Purpose | Data processed | Location | Safeguard |
|---|---|---|---|---|
| Razorpay Software Pvt Ltd | Payment processing for subscriptions | Payment instrument & billing details | India | PCI-DSS; RBI payment-data localisation |
We do not store full card numbers. Payment data is handled by our PCI-DSS-compliant payment processor in accordance with RBI directions on storage of payment data in India.
4. Website & Anti-Abuse
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Google reCAPTCHA | Bot and spam prevention on web forms | IP address, browser data | Global |
| Google Fonts | Web font delivery | IP address | Global |
5. Changes to This Register
We may add or replace sub-processors as the Service evolves. Material changes will be reflected on this page. Business customers requiring advance notice of sub-processor changes may request this in their Data Processing Addendum.
6. Cross-Border Transfer
Some sub-processors process data outside India. Such transfers are permitted under Section 16 of the DPDP Act, which allows transfer of personal data to countries other than those specifically restricted by the Central Government, subject to the contractual safeguards described above.
7. Contact
For questions about our sub-processors or to request a copy of our Data Processing Addendum, contact:
Hiyan Enterprises Pvt Ltd
Email: [email protected]
Grievance Officer: [email protected] · Grievance Officer page
See also our Privacy Policy.