Effective date: 14 October 2026
This notice supplements the Privacy policy. It identifies the service providers that receive personal data, where processing takes place and the safeguard each transfer rests on. Byudge's operator is in the Kyrgyz Republic; the primary database region does not confine all processing to that country or region. Where a provider is in the United States and certified under the EU-US Data Privacy Framework, transfers from the EU, UK and Switzerland rest on that certification; otherwise on the EU Standard Contractual Clauses with the UK and Swiss addenda contained in the provider's data-processing agreement linked below.
| Provider/service | Personal data and purpose | Location and transfer safeguard |
|---|---|---|
| Supabase | Sign-in/profile/session information, synced financial records, settings, chats and subscription status | Primary database and Auth: Zurich, Switzerland. Platform logs and any backups follow the provider's regional infrastructure. Supabase DPA with EU SCCs, UK Addendum and Swiss Addendum |
| Google (Gemini API) | Questions, chat context and relevant financial records to generate answers | Processing at Google facilities worldwide; abuse-monitoring retention is described in the Privacy Policy. Google Data Processing Addendum (EU-US Data Privacy Framework; SCCs where it does not apply) |
| Amazon Web Services (our server) | Assistant request processing and technical logs without question or answer text | Zurich, Switzerland (eu-central-2). AWS Data Processing Addendum with EU SCCs, UK and Swiss addenda, incorporated in the AWS Service Terms |
| Mixpanel | Usage/device/location and purchase/subscription event information; identified profile may include name, email, account ID and primary currency | EU ingestion endpoints. Mixpanel DPA with EU SCCs and UK Addendum |
| Google Analytics for Firebase; Firebase Crashlytics; Firebase Performance on iOS | Automatic app-use/device/identifier and approximate-location information; crash, performance and network measurements | Google processing locations worldwide. Firebase Data Processing and Security Terms (EU-US Data Privacy Framework; SCCs where it does not apply) |
| RevenueCat | Purchase tokens/receipts/status, customer identifiers, device information and supplied email; subscription management/restoration | United States (AWS data centers). RevenueCat DPA with EU SCCs and UK Addendum |
| Google Sign-In; Sign in with Apple | Identity authentication and supplied profile data | The identity provider operates its own account service under its own privacy policy and is an independent controller of it |
| Google Play; Apple App Store | Purchase, billing, restoration and platform services | The purchasing store controls its own consumer/payment records under its own policies |
| Cloudflare | Encrypted delivery of app-server and website traffic; forwarding of support email; visit counting where enabled | Global network. Cloudflare Customer DPA (EU-US Data Privacy Framework; SCCs with UK and Swiss provisions where it does not apply). Email content is forwarded, not stored |
| Google (Gmail) | Support correspondence and attachments you send, received through Cloudflare Email Routing | Google processing locations worldwide. Google Privacy Frameworks (EU-US Data Privacy Framework with UK and Swiss extensions; SCCs where required) |
You can request copies of the applicable safeguards at [email protected].
Access to data, erasure requests and retention follow the Privacy Policy and the Account deletion page. If a recipient or purpose changes, we update this notice and provide any required disclosure/consent before the affected processing.