BumbleB Technologies sub-processors
BumbleB Technologies Pvt Ltd (“BumbleB Technologies”) uses the third parties below to help provide the Service. This list covers every vendor that processes Customer Content, plus the vendors that handle Account Data only, listed in Section 4. Each one processes Customer Content or Personal Data only to provide its service to BumbleB Technologies, under written data-protection terms consistent with the protections in BumbleB Technologies’ Data Processing Agreement. BumbleB Technologies remains liable for their performance.
No training. BumbleB Technologies will not use Customer Content to train, retrain or fine-tune any AI model, and will not allow any sub-processor to do so. The only exception is a Submitted Conversation, which a user chooses to send us.
1. Hosting and email
| Sub-processor | Purpose | Data | Location | Retention & training terms |
|---|---|---|---|---|
| Microsoft Azure (Microsoft Corporation) | Primary hosting: application services, databases and storage; hosting and delivering the tracking tag and receiving tag events | All Customer Content (including Visitor Data from the tag), Account Data and Usage Data | United States (East US) | Holds data only as BumbleB Technologies directs and deletes it on BumbleB Technologies’ schedule. No training on Customer Content. Visitor Data is never used to improve the Service. |
| MongoDB Atlas (MongoDB, Inc.) | Managed database service, running on Microsoft Azure | Customer Content, Account Data and Usage Data stored in BumbleB Technologies’ databases | United States (Azure East US 2, Virginia) | Holds data only as BumbleB Technologies directs and deletes it on BumbleB Technologies’ schedule. No training on Customer Content. |
| Amazon Web Services (Amazon Web Services, Inc.) — Amazon SES | Transactional email: account, billing, security and service notices | Recipient email addresses and the content of those notices. No Customer Content, no Visitor Data. | Asia Pacific (Mumbai) | Holds message data only as needed to deliver email. No training on Customer Content. |
2. AI model providers
These providers receive the question and the context needed to answer it, to generate an answer (inference), and for nothing else. No provider receives data for training, evaluation or its own product improvement.
| Sub-processor | Purpose | Data | Location | Retention & training terms |
|---|---|---|---|---|
| OpenAI (OpenAI, L.L.C.) | Inference — generating answers, directly. Planned: text embeddings (text-embedding-3-small) for semantic search, directly — not before 8 November 2026 | Inputs and the context needed to answer them; Outputs; once embeddings start, text submitted for semantic search | United States | Inference only. Contractually barred from training on Customer Content. Zero data retention: enabled for BumbleB Technologies’ account, so OpenAI keeps no prompts or responses, apart from brief retention the law may require. |
BumbleB Technologies currently sends requests to OpenAI directly, with zero data retention, and uses no other model provider. BumbleB Technologies adds or replaces a model provider only with the notice in Section 7, and states each provider’s retention terms on this list. Any model BumbleB Technologies trains or fine-tunes for itself uses only Usage Data and Submitted Conversations, as the DPA allows.
AI assistants you connect are not sub-processors. If you connect BumbleB Crunch to an AI assistant you use, such as Claude or ChatGPT, the assistant’s provider receives your questions and BumbleB Crunch’s answers under your agreement with that provider. It acts for you, not for BumbleB Technologies, so it isn’t listed here (DPA Section 3.6). OpenAI appears on this list only as BumbleB Technologies’ provider for generating answers.
3. Tracking tag
The tracking tag is served from, and sends its events to, BumbleB Technologies’ own infrastructure on Microsoft Azure (Section 1). No other vendor is involved.
Customers who deploy the tag through their own Google Tag Manager account do so under their own Google terms, and Google is not BumbleB Technologies’ sub-processor for that.
4. Vendors that handle Account Data only
These vendors help BumbleB Technologies run its business. They receive Account Data only. BumbleB Technologies never sends them Customer Content; anything you choose to put in an email to us is held in Google Workspace.
| Vendor | Purpose | Data | Location |
|---|---|---|---|
| Razorpay | Taking payments and managing billing | Account Data only — no Customer Content | India |
| Google (Google LLC) — Google Sign-In and Google Workspace | Signing in users who choose “Sign in with Google”; BumbleB Technologies’ email, including support requests | Name, email address and Google profile identifier; emails to and from BumbleB Technologies | United States |
5. Software that is not a sub-processor
These run inside BumbleB Technologies’ own hosting environment. They are software BumbleB Technologies operates, not third parties that receive data: PostgreSQL, TimescaleDB and Valkey (databases); DuckDB (query engine); Apache Kafka (internal event streaming); Grafana Loki (log storage); Caddy (secure web proxy).
Third-party services that never receive Customer Content: GitHub (source code and container images) and Let’s Encrypt (TLS certificates).
Currently, no third-party error tracker, session-replay tool, product-analytics tool or AI debugging tool receives Customer Content. If that changes, this list changes first, with 30 days’ notice.
6. What every sub-processor is bound to
Each sub-processor is bound by written data-protection terms, consistent with the protections in the DPA, that require it to:
- process Personal Data only as needed to provide its service to BumbleB Technologies, on BumbleB Technologies’ instructions;
- not use it for its own purposes, and not sell or share it;
- not train any AI model on Customer Content;
- keep it confidential and secure;
- notify BumbleB Technologies of a breach promptly enough for BumbleB Technologies to meet its own 24-hour breach-notice commitment to customers, and help BumbleB Technologies respond to rights requests; and
- delete or return it when its service ends.
7. Changes, notice and objections
30 days’ notice. BumbleB Technologies gives at least 30 days’ notice before adding or replacing a sub-processor. Notice is given by updating this page and by email to everyone subscribed to changes and to each customer account’s administrators. If a sub-processor suffers a security incident, becomes insolvent or stops its service, BumbleB Technologies may replace it sooner, and will give notice as soon as practicable and in any case within 5 business days.
How to subscribe. Subscribe at https://bumbleb.co/legal/sub-processors#subscribe, or email privacy@bumbleb.co with the subject “Subscribe to sub-processor changes”.
Right to object. A customer may object to a new sub-processor on reasonable data-protection grounds by writing to privacy@bumbleb.co within the notice period. BumbleB Technologies will discuss the objection in good faith and may offer a way to provide the Service without that sub-processor processing the customer’s data. If the objection is not resolved within 30 days, the customer may terminate the affected Service and receive a refund of prepaid fees for the period after termination. The full terms are in Section 8 of the DPA.
Previous versions of this list are archived and linked from the top of this page.
8. Contacts
- Legal and contracts: legal@bumbleb.co
- Privacy: privacy@bumbleb.co
- Security: security@bumbleb.co
- Grievance Officer (India): Chinmaya Reddy, grievance@bumbleb.co
- Post: BumbleB Technologies Pvt Ltd, 581, Second Floor, 1st Main Rd, Sector 6, HSR Layout, Bengaluru, Karnataka 560102, India