Subprocessors & Transfers
Everyone who processes data on our behalf, and where.
Everyone who processes personal data on our behalf, what they get, and where they are. Ticked entries are active on this deployment; the rest are wired but not switched on.
| Who | What for | What they receive | Where |
|---|---|---|---|
| Cloud hosting provider | Hosting, storage, the call relay | Everything stored by the Service | United States |
| Chapa (Ethiopia) | Payments in birr — telebirr, CBE Birr and cards — paid straight to the seller, and sellers' birr payout accounts | For a buyer: the amount, their email and what they enter on Chapa's page. For a seller: the bank or wallet and account they give for payouts | Ethiopia |
| Stripe | Payments, payouts, subscriptions | Card details (never reaching us), amounts, buyer/seller identifiers | United States, and Stripe's own sub-processors |
| Email delivery provider | Sending account emails: confirming a recovery address, sign-in codes if you turn them on, password resets, a notice when your password changes, the welcome email when you join, an email when someone asks to connect with you, and order emails (your receipt and updates on an order) | The recipient's email address and the text of that one email (including its one-time code, which expires in 10 minutes; an order email carries the item, the amounts and the other person's username, never a delivery address) | United States |
| Browser push services (run by your device's or browser's maker) | Waking your phone for a call or message | An opaque subscription endpoint and encrypted payload | Varies by vendor |
| Google Firebase Cloud Messaging (and, for iPhones, Apple's push service through it) | Notifications in the iPhone and Android apps when the app is closed: calls, missed calls, orders, meetings, lives and reminders | The app's notification token and what the notification says, which is not encrypted to your device the way a browser notification is: who is calling or mentioned you (their username), an order's item and status, a meeting's or live's title. Never the text of your messages | United States, and Google's own sub-processors |
| Video provider | Carrying large meetings (only meetings a Business host chose to make large) and lives | The audio and video of the meeting or live as it happens (not stored), and each person's username, display name and network address | The provider's servers nearest the people in the meeting, which may be outside the United States |
| Shipping provider | Following a parcel when a seller gives a tracking number; buying a postage label when a seller chooses to | For tracking: the tracking number and carrier. For a label: the delivery and return addresses and the parcel's size and weight | United States |
| Translation service | Optional in-app translation, only when you tap translate | The text you chose to translate | United States |
| AI provider | Optional listing assistant that drafts a listing from your photo; and a check of every listing photo, and of a still from a host's camera every couple of minutes during a video live, for goods we do not allow; and a check of photos posted as updates or to channels, or sent to groups, open rooms and marketplace chats between people who aren't connected, for nudity, graphic violence and sexual content involving children | The photo and text you submit to the assistant; listing photos; those stills; those photos | United States |
The translation caveat, said plainly
Tapping translate sends that message's text to a third party, in the clear, so a company that had no part in your conversation receives it. The app asks first and sends only what you selected. This is worth a moment's thought even though messages here are not end-to-end encrypted to begin with: it widens who holds a copy from us to them.
The AI caveat
The listing assistant is used only on the Sell screen and only on what you give it. Every listing photo, and a still from the host's camera every couple of minutes during a video live, is also checked for goods we do not allow; the check only flags a picture for a person to look at, and never removes anything by itself. Photos posted as updates or to channels, and photos sent to groups, open rooms and marketplace chats between people who aren't connected, are checked the same way for nudity, graphic violence and sexual content involving children. The words of your conversations, your direct and private chats, calls and meetings are never sent to an AI provider for this check. Nothing is used to train a model.
International transfers
Where personal data of people in the EEA or UK reaches the United States, the transfer relies on the Standard Contractual Clauses together with the processor's own certification where it holds one. Outstanding: our own SCC module with each processor, and a transfer impact assessment, are not yet completed and executed. They are required before marketing this service in the EEA, and are listed here rather than implied to exist.
Changes
New sub-processors are added to this page before they start processing.
What has changed
6 November 2026 · version 14
- The AI provider also checks photos posted as updates or to channels, and photos sent to groups, open rooms and marketplace chats between people who aren't connected.
26 October 2026 · version 13
- Added Google Firebase Cloud Messaging, which delivers notifications to the iPhone and Android apps when they are closed. It receives the app's notification token and the notification's words (for example who is calling), never the text of your messages.
11 October 2026 · version 12
- The email delivery provider also sends order emails (receipts and order updates).
11 October 2026 · version 11
- The email delivery provider also sends the welcome email when you join and an email when someone asks to connect with you.
9 October 2026 · version 10
- Added Chapa, an Ethiopian payment gateway, for payments in birr (telebirr, CBE Birr, cards) and for sellers' birr payout accounts.
9 October 2026 · version 9
- The tracking provider is now the shipping provider: when a seller buys a postage label it also receives the delivery and return addresses and the parcel's size and weight.
9 October 2026 · version 8
- Added a tracking provider, which receives a parcel's tracking number and carrier when a seller gives one, to follow it.
9 October 2026 · version 7
- The AI provider also checks every listing photo, and a still from a host's camera every few minutes during a video live, for goods we do not allow. A match only puts the picture in front of our staff.
4 October 2026 · version 6
- Added an email delivery provider, which sends account-security emails (verification and sign-in codes, password resets, password-changed notices).
24 September 2026 · version 5
- The video provider now also carries lives (one person broadcasting to their contacts and followers).
24 September 2026 · version 4
- Added a video provider, which carries the audio and video of large meetings.
20 September 2026 · version 3
- The translation caveat no longer rests on a claim of end-to-end encryption — see the correction in Privacy.
29 August 2026 · version 2
- Added the object-storage provider now holding photos and voice notes.
12 July 2026 · version 1
- First published.