About this list
To run Apperah, we rely on a limited set of third-party providers that process personal data on our behalf and under our instructions. We require each one to operate under a data-processing agreement, to protect your data to standards consistent with our Privacy Policy, and to use your data only for the purpose shown.
Our sub-processors
| Provider | What they do for us | Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, database, media storage and delivery (CDN), caching | EEA (primary); some processing in the US |
| Anthropic (Claude) | AI — structuring public venue and event information; importing venue menus; automated safety review of event listings users submit (text and images) and of Open Invite photos; on-request assistive features (trip itinerary and checklist generation, schedule-photo scanning, translation of user-written content, replies in the in-app feedback conversation) | US |
| Google (Gemini) | AI — structuring public venue, place and event information from public venue pages (no Apperah user data; a public page may include a venue’s published contact details) | US |
| OpenRouter (routing to the inference provider serving the request — DeepInfra first) | AI — structuring public event information from public venue pages, as an alternative to Gemini (no Apperah user data; a public page may include a venue’s published contact details) | US |
| Synthetic (Synthetic Lab, Co.) | AI — structuring public venue and event information, which may include published contact details | US |
| OpenAI | AI — place descriptions and search-index preparation on public venue data (no Apperah user data) | US |
| PostHog | Product analytics — only if you turn analytics on; events are tied to your account ID, not your name or email, and carry the app version and build you are running | EU (US parent company) |
| Sentry | Error and crash reporting, service logs and performance monitoring (always on — service integrity). Server logs include one line per request with your IP address, the page requested and your account ID; passwords, tokens and sign-in secrets are removed before sending | US / EU region |
| Apple · Google · Meta | “Sign in with Apple / Google / Facebook”, if you choose it (also used for business and admin portal sign-in) | US |
| Resend | Transactional email delivery | US |
| Expo (delivered via Apple APNs / Google FCM) | Push notification delivery; app-performance telemetry (startup and screen timings — always on, no name or email); app update delivery — when the app checks for and downloads an update, Expo receives an install-scoped identifier and app-version details, never your name or account | US |
| OpenStreetMap (Nominatim) | Turning addresses into map coordinates | EEA / UK |
We render maps with map tiles from OpenFreeMap (a free, OpenStreetMap-based tile service); we plan to move to self-hosted tiles on our own cloud infrastructure. To discover public events and festivals, our catalogue pipeline also queries the Brave Search API — those queries contain only place, festival and country names, never personal data, so Brave does not process personal data on our behalf. Most processing happens in the EEA; some providers are in the United States, with the safeguards described below. We update this list before adding or replacing a provider.
International data transfers
Some providers are located outside the EEA/UK (mainly the United States). Where personal data is transferred internationally, we rely on appropriate safeguards — such as the EU Standard Contractual Clauses, the EU–US Data Privacy Framework where the provider is certified, and additional technical and organisational measures. See Privacy Policy → International transfers.
Changes to this list
We may add or replace providers as Apperah evolves. When we do, we will update this page. Business customers who want advance notice of changes can email privacy@apperah.com.
Paid-placement payments
Stripe processes paid-placement card and invoice payments for Apperah AS and handles payment data and provider records. Apperah AS remains the seller and determines its invoicing and tax obligations. Financial documents are archived privately in our AWS infrastructure with restricted access. Stripe may act as an independent controller for activities required by payment regulation and its own legal obligations. See Stripe Privacy and Stripe’s Data Processing Agreement.
More
- Privacy Policy · Business Privacy Notice
- Questions: privacy@apperah.com