Last reviewed: 2026-07-20
Sub-processors
These third parties may process personal data on Murmurly's behalf. Each entry lists what data they see, where it is processed, and the data-processing agreement that governs the relationship.
Push notification chain
Apple Inc.
APNs delivery
- Data
- device push tokens, payload in transit
- Region
- US
- DPA basis
- Apple Developer Program License Agreement, Schedule 2 + Attachment 1 (Apple Push Notification Service), auto-accepted on enrollment View agreement
Google LLC
FCM delivery
- Data
- device push tokens, payload in transit
- Region
- US + EU
- DPA basis
- Firebase Data Processing and Security Terms, auto-accepted on Firebase project creation View agreement
Expo Inc.
Expo Push relay
- Data
- device push tokens, payload in transit (~5 min storage)
- Region
- US (AWS us-east)
- DPA basis
- Expo Terms of Service §3.2 (GDPR — Standard Contractual Clauses, clauses 9, 11, 13, 17, 18) View agreement
Infrastructure
Supabase Inc.
Database, auth, storage
- Data
- authentication, encrypted journal data
- Region
- AWS ap-southeast-2 (Sydney)
- DPA basis
- Supabase Terms of Service Data Processing Addendum (auto-accepted) View agreement
Vercel Inc.
App hosting + CDN
- Data
- request metadata, application logs
- Region
- ap-southeast-2 (Sydney) compute; global edge CDN
- DPA basis
- Vercel Terms of Service Data Processing Addendum (auto-accepted) View agreement
Stripe Inc.
Payment processing (billing)
- Data
- cardholder name, payment-method tokens, billing email
- Region
- US
- DPA basis
- Stripe Terms of Service Data Processing Addendum (auto-accepted) View agreement
Resend Inc.
Transactional email delivery (DSR receipts, password-change alerts)
- Data
- recipient email address, transactional email body
- Region
- US
- DPA basis
- Resend Terms of Service Data Processing Addendum (auto-accepted) View agreement
AI sub-processors
Amazon Web Services, Inc.
Runs the Coach AI model (Anthropic Claude) via Amazon Bedrock for coach inference and session-summary generation
- Data
- conversation text, system prompts, and AI-generated replies during inference; processed inside Australia, not retained (zero data retention), and not shared with Anthropic
- Region
- Australia only: Sydney (ap-southeast-2) and Melbourne (ap-southeast-4), via the Amazon Bedrock Australia geographic inference profile
- DPA basis
- AWS Customer Agreement and AWS Data Processing Addendum (Standard Contractual Clauses incorporated), auto-accepted on account use View agreement
New or materially changed sub-processors require privacy review before activation. Back to privacy policy.