01About this list
These are the providers Appmetize LTD (deBub) uses to run the Service and that may process personal data. For personal data about you as a customer they act as our processors, as described in the Privacy & Cookie Policy. Where the column “End-user data” says yes, they may also process personal data of your app's users, as our sub-processors under the Data Processing Agreement.
Accounts you connect yourself, such as your own Supabase project, Vercel account, GitHub repository, email provider and Bubble app, are your own providers and not on this list.
02Current sub-processors
| Provider | Purpose | Location | Data | End-user data |
|---|---|---|---|---|
| Contabo GmbH | Our processing server: quick scan and full scan, code generation, the assistant's sandboxed workspace, hosted preview, customer-database setup, data copy and launch steps | Germany (EU)Processed in the EU | Bubble exports, scan results and screenshots, generated code, assistant attachments, job data including end-user data during a data copy | Yes |
| Supabase, Inc. | Our application database and private file storage | Ireland (EU, region eu-west-1)Stored in the EU; support access from the US under standard contractual clauses | Account and project records, uploaded exports, delivery files, assistant conversations and attachments, encrypted access tokens | Yes |
| Vercel Inc. | Hosting of the debub.io website and its API | United States, with a global edge networkEU–US Data Privacy Framework / standard contractual clauses | Requests to debub.io (including IP address), data passing through our API | Yes |
| Anthropic, PBC | AI models (Claude) that power the assistant, automated build fixes and plugin suggestions | United StatesStandard contractual clauses | Your messages and attachments, project code and files the assistant reads, feedback text for internal summaries | Yes |
| Clerk, Inc. | Sign-in, account management and session security | United StatesEU–US Data Privacy Framework / standard contractual clauses | Name, email address, sign-in method and security data (IP address, device); during sign-up, the sign-up source (the link's campaign tags, referring site and first page), deleted from Clerk once copied to our database | No |
| Stripe | Payments, subscriptions, invoices and fraud prevention | United States, Ireland and the UKEU–US Data Privacy Framework / standard contractual clauses | Name, email address, payment details (entered directly with Stripe), transaction history | No |
| Resend (Plus Five Five, Inc.) | Transactional email from deBub (for example, “your clone is ready”) and operational alerts | United States and the EUStandard contractual clauses | Recipient email address, email content | No |
| Google LLC (Google Workspace) | Our email inbox at hello@debub.io | Global (United States and other countries)EU–US Data Privacy Framework / standard contractual clauses | Emails you send us and our replies | No |
| GitHub, Inc.Only if you connect it | Only if you connect GitHub: our GitHub App creates a private repository in your account and pushes your code to it | United StatesEU–US Data Privacy Framework / standard contractual clauses | Your GitHub username, repository name and the generated code | No |
03Planned
We plan to use the following provider. It does not receive any data yet. We will update this page and give the notice described in the Data Processing Agreement before it starts.
| Provider | Purpose | Location | Data | End-user data |
|---|---|---|---|---|
| Backblaze, Inc. | Encrypted off-site backups of our processing server | Netherlands (EU, region eu-central)Processed in the EU | Backups, encrypted on our server before upload (Backblaze cannot read them) | Yes |
04Changes to this list
We will update this page and email customers at least 14 days before a new sub-processor starts processing end-user data, so you can object as described in the Data Processing Agreement. Questions: hello@debub.io.