Sub-processors

Version 1 · effective 30 Sep 2026 · All versions

Last updated: [EFFECTIVE DATE]

Draft status: starting draft for review. Items in square brackets are placeholders or points to confirm.

Bubbl uses the third parties below to provide the Service. Where a sub-processor handles personal data about End Users of Customer Apps, it acts as Bubbl's sub-processor under our Data Processing Agreement. Some also process data for which Bubbl is the controller (for example dashboard users and billing contacts), as described in our Privacy Policy.

We give at least 30 days' notice before adding or replacing a sub-processor, by updating this page and emailing each Workspace owner. Customers may object as set out in the DPA.

Name	Purpose	Data involved	Location / region	Transfer safeguard
Amazon Web Services [CONFIRM contracting entity, for example Amazon Web Services EMEA SARL]	Hosting and compute, PostgreSQL database, Redis cache and queues, file storage (S3), application logs (CloudWatch), and sending email (Simple Email Service)	All Service data: End User device, location, interaction and survey data; dashboard user accounts; Workspace content and media; email addresses and message content of service emails	UK: London (eu-west-2), primary. Ireland (eu-west-1), disaster-recovery backups. [CONFIRM SES region is eu-west-2]	UK hosting: no transfer. Ireland: UK adequacy regulations for the EEA. AWS Data Processing Addendum [CONFIRM it incorporates the IDTA or Addendum for any access from outside the UK/EEA]
Stripe [CONFIRM contracting entity, for example Stripe Payments Europe, Limited]	Subscription billing, payment processing, invoices and the billing portal	Customer billing data only: company and legal name, billing email, billing address, VAT number, payment method details (collected by Stripe), invoices and payment history. No End User data	EEA and United States	UK-US data bridge where Stripe, Inc. is certified [CONFIRM], otherwise the IDTA or Addendum in Stripe's DPA [CONFIRM]
Google LLC: Firebase Cloud Messaging	Delivering push notifications to Android devices	FCM registration token; notification content in the push payload (headline, body, image link, campaign and notification identifiers). Sent using the Customer's own Firebase project and credentials; for Showcase, Bubbl's Firebase project	Global; United States	UK-US data bridge (Google LLC certification) [CONFIRM], or the IDTA/Addendum in Google's data processing terms [CONFIRM]
Apple Inc.: Apple Push Notification service	Delivering push notifications to iOS devices	APNs device token; notification content in the push payload (title, body, image link, campaign and notification identifiers). Sent using the Customer's APNs key; for Showcase, Bubbl's key	Global; United States	[CONFIRM: UK-US data bridge certification, or Apple's own terms. Apple does not usually sign a sub-processor DPA for APNs]
Laravel Holdings Inc.: Laravel Nightwatch	Application performance monitoring and error tracking	Request metadata (route, URL, status, timing) and, for signed-in dashboard requests, the user's identifier [CONFIRM whether name and email are also sent]; database query text; queued job, email and notification metadata; exception details including source code. Request bodies are not captured. Authorization, Cookie and XSRF headers and password fields are redacted. Sampled: 25% of dashboard requests, 1% of device API requests, all errors. Device API URLs may include an approximate device position in the query string [CONFIRM]	European Union (Nightwatch EU region)	Stored in the EU; Laravel Holdings Inc. is a US company, so any access from the US relies on [CONFIRM: its DPA — UK IDTA/Addendum or the UK-US Data Bridge]
Google LLC: reCAPTCHA v3	Bot protection on dashboard sign-up	Sign-up page visitor's IP address, browser and device information, cookies and interaction data. No End User data	Global; United States	UK-US data bridge (Google LLC certification) [CONFIRM]
Mapbox, Inc.	Maps, place search and map thumbnails in the dashboard	Dashboard user's IP address and browser information, map area viewed, place search terms, and geofence shapes (for map thumbnails). Map telemetry [CONFIRM]. No End User data is sent by Bubbl's servers	United States	[CONFIRM: UK-US data bridge certification, or the IDTA/Addendum in Mapbox's DPA]