Last updated: July 7, 2026
This page lists the third parties that process personal data on behalf of, or in connection with, Bonded Studio (operated by Sapphire Labs) so that we can provide the Services. It supports the transparency requirements of Articles 13–14 and 28 GDPR and supplements the Privacy Policy, which remains the authoritative description of how we process personal data.
We keep this list current. Where a provider acts as an independent controller (for example, a payment provider or Merchant of Record for its own payment and fraud purposes), that provider processes data under its own terms and privacy policy in addition to any processing it performs for us.
Our primary application hosting is intended to remain in the European Union. Where a provider processes data outside the EU/EEA, we rely on an adequacy decision, the European Commission’s Standard Contractual Clauses (SCCs), and/or supplementary safeguards, together with a data processing agreement.
Infrastructure and hosting
| Provider | Purpose | Data involved | Location | Transfer safeguard |
| Hetzner Online GmbH | Application hosting, database, logs, infrastructure | Account, session, product, and log data | Germany (EU) | Within EU/EEA |
| Hostinger | Website (bonded.studio), newsletter, email, and domain hosting | Website, newsletter, and contact data | EU — [[CONFIRM: Hostinger data-centre region, e.g. Lithuania/EU]] | Within EU/EEA (confirm) |
| QUIC.cloud (LiteSpeed Technologies, Inc.) | Website CDN and caching (via LiteSpeed Cache) | Technical request data, IP address, cached content | United States / global edge | SCCs |
Authentication
| Provider | Purpose | Data involved | Location | Transfer safeguard |
| Apple Inc. | Sign in with Apple | Apple relay identifier, sign-in status | United States | SCCs / independent controller |
| Google LLC | Sign in with Google | Google account identifier, email, sign-in status | United States | SCCs / independent controller |
Payments and subscriptions
| Provider | Purpose | Data involved | Location | Transfer safeguard |
| Apple Inc. | App Store in-app purchases and auto-renewable subscriptions | Purchase/subscription status, Apple transaction data | United States | Independent controller for payments; SCCs where applicable |
| RevenueCat, Inc. | Subscription entitlement management, receipt handling, restore/sync, app user ID mapping | Entitlement status, app user ID, purchase metadata | United States | SCCs |
| Paddle.com Market Ltd (Paddle) | Merchant of Record for web checkout — payment processing, tax calculation/remittance, receipts, buyer email, refunds, chargebacks | Buyer email, purchase details, payment status (Paddle handles card data; we do not receive full card numbers) | United Kingdom / EU / United States | UK adequacy decision + SCCs; independent controller / Merchant of Record |
Communications
| Provider | Purpose | Data involved | Location | Transfer safeguard |
| Resend (Resend, Inc.) | Transactional email delivery (sign-in links, password resets, gift-code emails, service messages) | Email address, message content/metadata | United States | SCCs |
| Expo / EAS (650 Industries, Inc.) | Mobile push-notification delivery | Expo push token, notification payload | United States | SCCs |
Analytics
| Provider | Purpose | Data involved | Location | Transfer safeguard |
| Google LLC (Google Analytics 4) | Website analytics, traffic measurement, campaign performance | Pseudonymous usage/event data, IP-derived data, device/browser data | United States | SCCs — loaded only after consent (see Cookie Policy) |
Note on the web-to-app funnel and the mobile app: product analytics for the funnel (start.bonded.studio) and in-app behavioural events are first-party and stored on our own EU infrastructure (Hetzner); they are not sent to Google Analytics. See the Privacy Policy and the web-to-app data guide for details.
Artificial intelligence
We do not use any third-party AI provider to process users’ personal data or to make automated decisions about users. AI tools may be used internally by our team to help draft editorial/website content (see Disclosures §7); this does not involve users’ personal data.
Professional and legal recipients
In addition to the sub-processors above, we may disclose personal data to legal, accounting, and tax advisers, and to courts, regulators, or authorities where legally required, as described in the Privacy Policy. These are recipients rather than routine sub-processors.
Changes
We may add or replace sub-processors as the Services evolve. Material changes will be reflected here; where required, we will provide additional notice or seek consent. For questions about a specific provider or its transfer safeguards, contact support@bonded.studio.