Current list of third parties that process personal data on our behalf for altx forms.
A sub-processor is a third-party service Altx engages to process personal data on our behalf as we deliver altx forms. Every sub-processor with access to your personal data operates under our master Data Processing Agreement (ACPL/DPDPA/R601) in addition to its own DPA where applicable. This page is the source of truth for the current list and is updated whenever we engage a new sub-processor.
The full Record of Processing Activities (RoPA) that maps each sub-processor to the specific activities it serves is maintained internally and made available to regulators and to enterprise customers under NDA.
Payment-card data is captured directly by the payment processor; Altx sees only transaction metadata.
AI providers are invoked only when an account-holder uses an AI feature (form generation, conversational analytics, response intelligence). Prompts (which may include user-form content) are sent ephemerally to the relevant provider; outputs are returned and stored against the form / form response in Altx’s systems. We have contractually instructed each provider that identifiable Customer Data may NOT be used to train shared models without our explicit consent.
Where required by law — court orders, lawful statutory requests, regulator inquiries — we may disclose personal data to Indian authorities (Income Tax Department, GSTN / tax authorities, CERT-In, Data Protection Board of India, police and courts). These disclosures are not made on our instructions; they are mandated by law. We log every such disclosure for audit purposes.
ap-south-1(Mumbai, India). The AI providers (Anthropic, OpenAI), Stripe, Auth0, Chargebee, and Google Workspace process limited data outside India under their own Data Processing Agreements. We monitor restricted-country notifications issued by the Data Protection Board of India under Section 16 of the DPDPA and will update this page on any change.When we engage a new sub-processor that handles personal data, we update this page before the new sub-processor begins processing. For material changes that introduce a new purpose, a new sensitive data category, or a new cross-border transfer, we will notify our customers by email at least 30 days in advance and, where required by law, obtain fresh consent before the change takes effect.
For questions about our sub-processors or to request a copy of an executed DPA under NDA:
Data Protection Officer: dpo@altx.one
Privacy queries: privacy@altx.one