BumbleB sub-processors
BumbleB Technologies Pvt Ltd (“BumbleB”) uses the third parties below to help provide the Service. This list covers every vendor that processes Customer Content, plus the vendors that handle Account Data only, listed in Section 4. Each one processes Customer Content or Personal Data only to provide its service to BumbleB, under written data-protection terms consistent with the protections in BumbleB’s Data Processing Agreement. BumbleB remains liable for their performance.
No training. BumbleB will not use Customer Content to train, retrain or fine-tune any AI model, and will not allow any sub-processor to do so. The only exception is a Submitted Conversation, which a user chooses to send us.
1. Hosting and email
| Sub-processor | Purpose | Data | Location | Retention & training terms |
|---|---|---|---|---|
| Microsoft Azure (Microsoft Corporation) | Primary hosting: application services, databases and storage | All Customer Content, Account Data and Usage Data | United States (East US) | Holds data only as BumbleB directs and deletes it on BumbleB’s schedule. No training on Customer Content. |
| MongoDB Atlas (MongoDB, Inc.) | Managed database service, running on Microsoft Azure | Customer Content, Account Data and Usage Data stored in BumbleB’s databases | United States (Azure East US 2, Virginia) | Holds data only as BumbleB directs and deletes it on BumbleB’s schedule. No training on Customer Content. |
| Amazon Web Services (Amazon Web Services, Inc.) — Amazon SES | Transactional email: account, billing, security and service notices | Recipient email addresses and the content of those notices. No Customer Content, no Visitor Data. | Asia Pacific (Mumbai) | Holds message data only as needed to deliver email. No training on Customer Content. |
2. AI model providers
These providers receive the question and the context needed to answer it, to generate an answer (inference), and for nothing else. No provider receives data for training, evaluation or its own product improvement.
| Sub-processor | Purpose | Data | Location | Retention & training terms |
|---|---|---|---|---|
| OpenAI (OpenAI, L.L.C.) | Inference — generating answers, directly and through OpenRouter. Planned: text embeddings (text-embedding-3-small) for semantic search, directly — not before 8 November 2026 | Inputs and the context needed to answer them; Outputs; once embeddings start, text submitted for semantic search | United States | Inference only. Contractually barred from training on Customer Content. May retain prompts up to 30 days for abuse monitoring. Zero retention: not enabled. |
| OpenRouter (OpenRouter, Inc.) | Routing inference requests to the model provider that serves them | As above | United States | Inference only. Does not keep prompts (BumbleB has not opted in to logging). Every request requires zero data retention, so it is served only by model providers that do not store or train on prompts, apart from brief retention a provider must keep by law. |
Every request BumbleB sends through OpenRouter requires zero data retention, on every plan, and is served only by model hosts that accept it. OpenAI has not enabled zero retention for BumbleB, so OpenAI may keep prompts, and embedding inputs once embeddings start, for up to 30 days for abuse monitoring. BumbleB does not operate any fine-tuned models.
3. Tracking tag
The components that place and serve the tracking tag on Customer websites.
| Sub-processor | Purpose | Data | Location | Retention & training terms |
|---|---|---|---|---|
| Microsoft Azure (Microsoft Corporation) | Hosting and delivering the tag from BumbleB’s own infrastructure, and receiving tag events | Visitor Data transmitted by Customer’s configured tag | United States (East US) | As for hosting above. Visitor Data is never used to improve the Service. |
Customers who deploy the tag through their own Google Tag Manager account do so under their own Google terms, and Google is not BumbleB’s sub-processor for that.
4. Vendors that handle Account Data only
These vendors help BumbleB run its business. They receive Account Data only and never receive Customer Content.
| Vendor | Purpose | Data | Location |
|---|---|---|---|
| Razorpay | Taking payments and managing billing | Account Data only — no Customer Content | India |
| Google (Google LLC) — Google Sign-In | Signing in users who choose “Sign in with Google” | Name, email address and Google profile identifier — Account Data only | United States |
5. Software that is not a sub-processor
These run inside BumbleB’s own hosting environment. They are software BumbleB operates, not third parties that receive data: PostgreSQL, TimescaleDB and Valkey (databases); DuckDB (query engine); Apache Kafka (internal event streaming); Grafana Loki (log storage); Caddy (secure web proxy).
Third-party services that never receive Customer Content: GitHub (source code and container images) and Let’s Encrypt (TLS certificates).
No third-party error tracker, session-replay tool, product-analytics tool or AI debugging tool receives Customer Content. If that changes, this list changes first, with 30 days’ notice.
6. What every sub-processor is bound to
Each sub-processor is bound by written data-protection terms, consistent with the protections in the DPA, that require it to:
- process Personal Data only as needed to provide its service to BumbleB, on BumbleB’s instructions;
- not use it for its own purposes, other than limited abuse monitoring by AI model providers as stated in Section 2, and not sell or share it;
- not train any AI model on Customer Content;
- keep it confidential and secure;
- notify BumbleB of a breach promptly enough for BumbleB to meet its own 24-hour breach-notice commitment to customers, and help BumbleB respond to rights requests; and
- delete or return it when its service ends.
7. Changes, notice and objections
30 days’ notice. BumbleB gives at least 30 days’ notice before adding or replacing a sub-processor. Notice is given by updating this page and by email to everyone subscribed to changes and to each customer account’s administrators. If a sub-processor suffers a security incident, becomes insolvent or stops its service, BumbleB may replace it sooner, and will give notice as soon as practicable and in any case within 5 business days.
How to subscribe. Subscribe at https://bumbleb.co/legal/sub-processors#subscribe, or email privacy@bumbleb.co with the subject “Subscribe to sub-processor changes”.
Right to object. A customer may object to a new sub-processor on reasonable data-protection grounds by writing to privacy@bumbleb.co within the notice period. BumbleB will discuss the objection in good faith and may offer a way to provide the Service without that sub-processor processing the customer’s data. If the objection is not resolved within 30 days, the customer may terminate the affected Service and receive a refund of prepaid fees for the period after termination. The full terms are in Section 8 of the DPA.
Previous versions of this list are archived and linked from the top of this page.
8. Contacts
- Legal and contracts: legal@bumbleb.co
- Privacy: privacy@bumbleb.co
- Security: security@bumbleb.co
- Grievance Officer (India): Chinmaya, grievance@bumbleb.co
- Post: BumbleB Technologies Pvt Ltd, 581, Second Floor, 1st Main Rd, Sector 6, HSR Layout, Bengaluru, Karnataka 560102, India