Effective date: 25 October 2026
This notice supplements the Privacy policy. It identifies the service providers that receive personal data, where processing takes place and the safeguard each transfer rests on. Byudge's operator is in the Kyrgyz Republic; the primary database region does not confine all processing to that country or region. Where a provider is in the United States and certified under the EU-US Data Privacy Framework, transfers from the EU, UK and Switzerland rest on that certification; otherwise on the EU Standard Contractual Clauses with the UK and Swiss addenda contained in the provider's data-processing agreement linked below.
| Provider/service | Personal data and purpose | Location and transfer safeguard |
|---|---|---|
| Supabase | Sign-in/profile/session information, synced financial records, settings, chats and subscription status | Primary database and Auth: Zurich, Switzerland. Platform logs and any backups follow the provider's regional infrastructure. Supabase DPA with EU SCCs, UK Addendum and Swiss Addendum |
| Google (Gemini API) | Questions, chat context and relevant financial records to generate answers | Processing at Google facilities worldwide; abuse-monitoring retention is described in the Privacy Policy. Google Data Processing Addendum (EU-US Data Privacy Framework; SCCs where it does not apply) |
| Amazon Web Services (our server) | Assistant request processing and technical logs without question or answer text | Zurich, Switzerland (eu-central-2). AWS Data Processing Addendum with EU SCCs, UK and Swiss addenda, incorporated in the AWS Service Terms |
| Grafana Labs (Grafana Cloud) | Monitoring of our server: technical logs, request traces and metrics carrying the account ID, timings, outcomes, error types, token counts and memory figures — no question or answer text, names or amounts. Kept up to 31 days | Stack hosted in Zurich, Switzerland (AWS eu-central-2); Grafana Labs is a US company and its infrastructure and support providers include US entities. Grafana Labs Data Processing Agreement with EU SCCs, the UK International Data Transfer Agreement and Swiss provisions; Grafana Labs states participation in the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework |
| Mixpanel | Usage/device/location and purchase/subscription event information; identified profile may include name, email, account ID and primary currency | EU ingestion endpoints. Mixpanel DPA with EU SCCs and UK Addendum |
| Google Analytics for Firebase; Firebase Crashlytics; Firebase Performance on iOS | Automatic app-use/device/identifier and approximate-location information; crash, performance and network measurements | Google processing locations worldwide. Firebase Data Processing and Security Terms (EU-US Data Privacy Framework; SCCs where it does not apply) |
| RevenueCat | Purchase tokens/receipts/status, customer identifiers, device information and supplied email; subscription management/restoration | United States (AWS data centers). RevenueCat DPA with EU SCCs and UK Addendum |
| Google Sign-In; Sign in with Apple | Identity authentication and supplied profile data | The identity provider operates its own account service under its own privacy policy and is an independent controller of it |
| Google Play; Apple App Store | Purchase, billing, restoration and platform services | The purchasing store controls its own consumer/payment records under its own policies |
| Cloudflare | Encrypted delivery of app-server and website traffic; forwarding of support email; visit counting where enabled | Global network. Cloudflare Customer DPA (EU-US Data Privacy Framework; SCCs with UK and Swiss provisions where it does not apply). Email content is forwarded, not stored |
| Meta Platforms (Meta Pixel on byudge.com), after consent | Page visits, PageView events, time, referring-page information, cookie/ad-click identifiers (_fbp, _fbc), IP and browser/device information; advertising measurement. No app financial records, account details, form text or email. Withdraw in Cookie settings |
Processing internationally, including the US. Under Business Tools Terms, GDPR collection/transmission is jointly controlled with Meta Platforms Ireland Limited, Dublin (Controller Addendum); under UK GDPR, with Meta Platforms, Inc., US (UK Controller Addendum). Other processing roles follow those terms and the Data Processing Terms. Applicable safeguards: EU/EEA/Swiss transfer addendum (Meta Inc. states EU-US DPF certification; SCCs where applicable), UK transfer addendum (UK addendum to SCCs), and Global transfer addendum for its specified jurisdictions. Meta's further use and cookies follow its Privacy Policy and Cookies Policy |
| Google (Gmail) | Support correspondence and attachments you send, received through Cloudflare Email Routing | Google processing locations worldwide. Google Privacy Frameworks (EU-US Data Privacy Framework with UK and Swiss extensions; SCCs where required) |
You can request copies of the applicable safeguards at support@byudge.com.
Access to data, erasure requests and retention follow the Privacy Policy and the Account deletion page. If a recipient or purpose changes, we update this notice and provide any required disclosure/consent before the affected processing.