Service Providers And Subprocessors

Overview

Boba Globe uses the service providers below to operate the app, process payments, send service emails, provide route features, and protect the service. Depending on the privacy law or contract that applies, these providers may be described as service providers, processors, subprocessors, independent controllers, or recipients.

Some services you choose to use act under their own terms rather than as Boba Globe providers: Google or Apple when you sign in with those accounts, the cloud storage provider you pick for optional route backup (such as iCloud Drive or Google Drive), and any app or destination you share a video to. Their own privacy policies apply to that use.

Current Providers

• Apple App Store and Google Play: Mobile app distribution, in-app subscription purchases, receipts, refunds, and purchase restoration. Store account and payment processing follow the store’s own privacy practices. Data involved: Store product and transaction information, purchase verification references, account-binding identifiers, subscription status, renewal state, and expiry. Boba Globe does not receive full payment-card numbers.Provider legal links: Apple Privacy Policy, Google Privacy Policy.
• Supabase: Authentication, database, storage, session handling, and row-level access control, including Boba Globe's mobile billing, promo-code, partner, and account deletion request records. Data involved: Account data, profile data, saved website projects, thumbnails, session information, store purchase records with encrypted verification references, promo-code and commission records, deletion request records, rate-limit data, and related service metadata. Mobile journeys and videos are not stored here.Provider legal links: Privacy Policy, Data Processing Addendum, Security.
• Boba Globe authentication (hosted on Supabase): Sign-in for the Boba Globe website, iOS and Android apps through a dedicated Boba Globe Supabase project. Data involved: Account identifier, email address (or Apple private relay address), sign-in provider profile information, and session and token metadata. Boba Globe journeys, videos, and Boba billing records are not stored in this project.Provider legal links: Supabase Privacy Policy, Supabase Data Processing Addendum.
• Stripe: Website checkout, payment processing, invoices, receipts, subscription status, and billing portal access. Data involved: Billing contact information, Stripe customer and subscription identifiers, invoice and receipt metadata, payment status, and subscription lifecycle events. Boba Globe does not store full card numbers.Provider legal links: Privacy Policy, Data Processing Agreement, Service Providers.
• PostHog: Product analytics, error tracking, and, on the website only when you allow analytics cookies, masked session replay. Data is hosted in PostHog US Cloud. Data involved: Pages and app screens viewed, product events, export and purchase outcomes, device and browser type, IP-derived approximate location, and error reports. With opt-in: a random device identifier, Boba Globe account identifier, and masked website session replays. Email addresses are not sent.Provider legal links: Privacy Policy, Data Processing Agreement.
• AWS SES: Authentication emails, account notices, subscription lifecycle emails where enabled, and delivery of app and website support or feedback messages to the Boba Globe support inbox. Data involved: Recipient and sender email addresses, message content, attached support images, app version and platform details for support messages, delivery metadata, and provider tags needed to send service emails.Provider legal links: AWS Privacy Notice, AWS Data Processing Addendum, Services In Scope.
• Vercel: Application hosting, deployment, request handling, security headers, and operational logs. Data involved: Technical and security data such as request metadata, IP address, status codes, error details, and limited internal account, project, subscription, or provider event identifiers in structured operational logs.Provider legal links: Privacy Policy, Data Processing Addendum, Security And Compliance.
• Amazon CloudFront or CDN provider: Production texture delivery and any other CDN-hosted static assets configured for the app. Data involved: Technical request metadata needed to deliver and protect CDN-hosted static assets. Route object models and previews currently ship from the app's same-origin hosting path.Provider legal links: CloudFront Data Protection, AWS Privacy Notice, AWS Data Processing Addendum.
• Amazon S3 (AWS Open Data Terrain Tiles): Public elevation tiles streamed to the website and apps when Terrain 3D relief needs more detail than the bundled base tiles. The dataset is hosted by AWS as open data. Data involved: Technical request metadata such as IP address, device or browser metadata, and the requested tile coordinates, which reflect the map area being viewed. No account, journey, or route details are sent.Provider legal links: Terrain Tiles On AWS Open Data, AWS Privacy Notice.
• unpkg or npm package CDN: Browser delivery of FFmpeg core JavaScript and WebAssembly assets when fallback video export is enabled and used. Data involved: Technical request metadata such as IP address, browser metadata, URL, and timing needed to deliver package assets. Project frames are encoded locally in the browser and are not sent to the package CDN for encoding.Provider legal links: unpkg, npm Privacy Notice, FFmpeg WASM.
• Flightradar24: Historical flight search and track data when you request flight-route import features. Data involved: Flight number, selected flight identifier, date range, and returned route or track information.Provider legal links: Privacy Policy, Terms of Service.
• Geoapify: Place autocomplete, geocoding, and driving/transit route geometry when Geoapify route features are enabled and requested. Data involved: Search query, selected place details, origin, destination, route request details, and returned route geometry.Provider legal links: Privacy Policy, Terms and Conditions, OpenStreetMap Attribution.
• Wikimedia Foundation (Wikipedia): Ranking well-known landmarks when you search for a place in the apps. Data involved: The place search text only, sent from Boba Globe's servers without account or device identifiers.Provider legal links: Privacy Policy, Terms of Use.
• BusMaps: Public-transit, rail, subway, and tram route geometry and timing when BusMaps transit route features are enabled and requested. Data involved: Origin and destination coordinates, selected place details, route mode, route request details, and returned public-transit route geometry and timing.Provider legal links: Terms and Conditions, Privacy and Cookies Policy, API Documentation.
• Google Maps Platform: Optional Places autocomplete and driving/transit route geometry when Google route features are approved, enabled, and requested. Data involved: Search query, selected place identifiers, origin, destination, route request details, and returned route geometry.Provider legal links: Maps Platform Terms, Google Privacy Policy, Cloud Data Processing Addendum.

Provider Contract Review

Boba Globe reviews provider privacy terms, data-processing terms, security commitments, transfer terms, subprocessor notice processes, and retention or deletion obligations before treating a provider as approved for launch. These public links are provided for transparency, but the signed or accepted contract terms may vary by plan, account, region, and provider configuration.

International Transfer Safeguards

Providers may process information in the United States and other countries where they or their subprocessors operate. Where privacy laws require transfer safeguards, Boba Globe reviews lawful transfer mechanisms such as adequacy decisions, the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, provider data-processing terms, transfer-risk assessments, and supplementary technical, contractual, or organisational measures where appropriate.

Route Provider Use

Flightradar24, Geoapify, BusMaps, and Google Maps Platform are used only when you request the related flight, place autocomplete, or directions-route features and when those features are available to your account. If you do not request those features, Boba Globe does not send your route queries to those providers.

Updates

We may update this list when Boba Globe changes providers, adds a material provider, or removes a provider. Changes are reflected by the last updated date above.

Contact

Questions about service providers or subprocessors can be sent to [email protected].