Sub-processors
Third-party data processors that may receive merchant data via the Plugin Integration API, with the GDPR Article 28(2) disclosure surface.
The Plugin Integration API uses the same sub-processor list as the rest of Qamera AI, returned dynamically from GET /me so plugin authors never have to hard-code it.
Programmatic disclosure
curl https://qamera.ai/api/v1/plugin/me \ -H "X-Api-Key: mk_live_xxxxxxxx.yyyyyyyy"
The response includes a data_processors array. Each item has:
| Field | Description |
|---|---|
name | Trade name of the processor (e.g. "Google Cloud Platform"). |
purpose | What the processor does in the pipeline (e.g. "Object storage for source assets and outputs"). |
region | Hosting region (e.g. "EU"). |
category | One of storage, model_provider, infrastructure, analytics. |
Surface this list to merchants in your installation flow so they can comply with GDPR Article 28(2) before activating the plugin.
Public reference
The authoritative, always-current list is the data_processors array returned by GET /me. When the list changes we email account owners 30 days in advance and bump the version returned by /me.
Categories
- Storage — object stores that hold raw uploads + generated outputs.
- Model providers — third-party generative model APIs (e.g. Google Gemini, OpenAI, Pollo, Kling).
- Infrastructure — compute, queueing, observability, email transport.
- Analytics — usage metrics; never receive merchant content.
If the merchant restricts processors via a contractual addendum, set the corresponding installation flag — the dispatcher will route around the disabled providers and POST /jobs returns 400 invalid_input with data_processors_unavailable if a request would require one of them.