Privacy Policy – Annex 3: Subprocessors
Last updated: 3 June 2026
Scope
This page lists the third-party service providers (“Subprocessors” under Art. 28 GDPR / UK GDPR, “service providers” under the California Consumer Privacy Act) we engage to operate the BUSY service. Each processes personal data on our behalf and under our written instructions, with a data processing agreement (or equivalent contractual safeguards) in place where required by applicable law.
This page does not list:
- Advertising and analytics partners (e.g. Meta Pixel, Google Ads, Microsoft Clarity) – these determine their own purposes for the data they receive and act as controllers or joint controllers, not processors. They are named in our Cookie Policy and, where joint controllership applies, on our Controllers Page (Annex 1).
- Identity providers you use (Apple, Google, Microsoft sign-in; Google Calendar) – these act on your direction and remain controllers of their own services.
- Tools we host ourselves (e.g. self-hosted crash and product analytics) – no third-party data recipient is involved.
Current Subprocessors
| # | Subprocessor | Role | Categories of personal data | Region | Flipper contracting entity |
|---|---|---|---|---|---|
| 1 | Shopify Payments (USA) Inc. | Payment processing and fraud-prevention for online purchases | Order data, payment-method tokens, billing address, IP address | USA, EU | Flipper Devices, Inc. |
| 2 | Shopify Inc. | Storefront and checkout platform for busy.app | Order data, contact details, shipping address, account identifiers | Canada, USA | Flipper Devices, Inc. |
| 3 | Sendinblue SAS (Brevo) | Marketing email delivery and contact-list management | Email address, name, marketing-engagement events, consent records | EU (France) | Flipper Devices, Inc. |
| 4 | Google LLC (Google Cloud Platform) | Cloud hosting, database, storage, and backups for the BUSY app and BUSY Cloud (Stage/Prod in us-east4; Dev in europe-west1) | Account data, app data, device telemetry, support content, and other personal data stored within the service | USA (us-east4), EU (europe-west1) | Flipper FZCO |
| 5 | Zendesk, Inc. | Customer-support helpdesk (tickets, conversations, knowledge base) | Support ticket content, contact details, account identifiers, order references | USA, EU | Flipper Devices, Inc. |
| 6 | Apple Inc. (APNs) and Google LLC (Firebase Cloud Messaging) | Push-notification delivery to the BUSY app | Device push token, notification payload (e.g. BUSY Timer start/stop events) | USA | Flipper FZCO |
| 7 | Regional fulfilment and 3PL partners – GoSincro Inc. (US), T-Rex Logistics Solutions Ltd. (Canada), U-Freight Holland BV (Netherlands), U-Freight UK Limited (United Kingdom) | Warehousing, order fulfilment, courier delivery, returns logistics | Name, shipping address, phone, order contents | Per region | Flipper Devices, Inc. |
| 8 | Easyship (via Shopify) | Shipping rate comparison, label generation, and shipment tracking | Name, shipping address, phone, order contents, tracking events | USA | Flipper Devices, Inc. |
| 9 | Metricool SL | Social-media analytics and content scheduling | Social-media engagement data, audience metrics | EU (Spain) | Flipper Devices, Inc. |
Cross-references
- controllers and joint controllers (including Meta, Google Ads): Controllers Page (Annex 1).
- Cookies, advertising partners, and consent controls: Cookie Policy.
- International transfers (SCCs and UK Addendum): Privacy Policy, Section 6.
How we manage Subprocessors
- Each subprocessor signs a data processing agreement that meets the requirements of Art. 28 GDPR (and UK GDPR equivalents). We engage subprocessors under a general written authorization (Art. 28(2) GDPR). We notify users of intended additions or replacements via this page; users with concerns may contact us at privacy@flipper.net.
- Where required for transfers outside the EEA / UK, we rely on an appropriate Art. 46 GDPR transfer mechanism (such as the SCCs and the UK IDTA, or an applicable adequacy decision or Data Privacy Framework certification).
- We take reasonable steps to assess Subprocessor security and privacy posture.
- We may update this page from time to time to reflect changes to our Subprocessors.