Sub-processors
The service providers Humbugg uses to process personal data on our behalf, and how each transfer out of the EEA/UK is protected.
Version 2026.11 · Effective October 18, 2026
Who processes data for us
We use a small number of service providers (“sub-processors”) to run Humbugg. Each one is bound by a data processing agreement that incorporates the EU Standard Contractual Clauses (SCCs), which is how personal data from the EEA/UK is protected when it reaches a provider in the United States. See our Privacy Policy, particularly “How we share information.”
| Processor | Purpose | Data categories | Region | Transfer mechanism |
|---|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Hosting and content delivery (Lambda, CloudFront), authentication (Cognito), database (DynamoDB), file storage (S3), transactional email (SES) | Account identifiers, verified email address, exchange content, wish lists, addresses, profile photos, audit records, and the IP address and browser details every request carries | us-east-1 (N. Virginia) | AWS GDPR Data Processing Addendum (incorporated in the AWS Service Terms) with EU Standard Contractual Clauses; UK Addendum |
| Stripe, Inc. | Payment processing for Plus | Name, email, and billing details as entered on Stripe Checkout — Humbugg never stores your card data | United States | Stripe Data Processing Agreement (incorporated in the Stripe Services Agreement), SCCs |
| Google LLC (Google Workspace) | The support mailbox, support@humbugg.com | Whatever you send to support | United States | Google Workspace Data Processing Addendum, SCCs |
Services that are not sub-processors
Some services receive data from Humbugg but decide for themselves how to use it, under their own privacy policies. They are independent controllers, not sub-processors, so they are not in the table above. Our Privacy Policy explains what each one receives.
- Google (Places) — suggests addresses as an organizer types an exchange location. It receives the search text from our servers, not who typed it.
- Google (Ads) — only if you accept advertising cookies: learns when a visit that began with one of our ads goes on to create or join an exchange.
- Google, Microsoft, Meta (Facebook) and LinkedIn sign-in — only if you choose to sign in with them: confirm who you are and send us your name and email address.
Changes to this list
We update this page before a new sub-processor starts handling personal data on our behalf. If you would like to be notified of changes, email us at support@humbugg.com.