Sub-processors
Claar engages carefully selected third parties to help deliver the platform and perform identity verification. This page lists those sub-processors, the categories of personal information they receive, and where they process it.
Last updated · 20 April 2026
1. Purpose of this list
Under the Protection of Personal Information Act (POPIA), data subjects are entitled to know who processes their personal information. This page names each sub-processor that receives personal information in the course of using Claar, together with the purpose of the processing and the jurisdiction in which it takes place.
2. Current sub-processors
Smile ID — Smile Identity, Inc.
- Purpose: Identity verification — authenticating ID documents and performing a liveness (anti-spoofing) selfie match.
- Processing location: United States, with regional processing in Kenya and South Africa
- Categories of personal information: ID document image; Selfie and short video liveness capture; Biometric face template; Device, browser and session metadata.
- Privacy policy: https://usesmileid.com/privacy-policy/
- Data processing agreement: https://usesmileid.com/data-processing-agreement/
Sumsub — Sum and Substance Ltd
- Purpose: Identity verification — authenticating ID documents and performing a liveness (anti-spoofing) selfie match. Retained as a fallback KYC provider.
- Processing location: United Kingdom
- Categories of personal information: ID document image; Selfie and short video liveness capture; Biometric face template; Device, browser and session metadata.
- Privacy policy: https://sumsub.com/privacy-notice/
- Data processing agreement: https://sumsub.com/dpa/
Amazon Web Services — Amazon Web Services, Inc.
- Purpose: Hosting the platform, running application compute, and storing personal information with encryption at rest.
- Processing location: South Africa (af-south-1 region)
- Categories of personal information: All personal information processed by the platform.
- Privacy policy: https://aws.amazon.com/privacy/
3. Cross-border transfers
Where a sub-processor is located outside South Africa, we rely on section 72 of POPIA. This includes ensuring the recipient is subject to a law, binding corporate rules, or binding agreement that provides a level of protection substantially similar to that offered under POPIA, and that the transfer is necessary to perform the contract with the data subject or for the data subject's benefit.
4. Changes to this list
We may change sub-processors from time to time. When a change affects the categories of personal information shared or introduces a new jurisdiction, we will update this page and, where the change is material, obtain fresh consent from data subjects before continuing to process their information under the new arrangement.
5. Contact
For questions about our sub-processors, contact our Information Officer at privacy@claar.co.za.