Core Product Vendors
| Subprocessor | Purpose | Product function | Categories of data processed | Countries where data may be processed | Use |
|---|---|---|---|---|---|
| Google Cloud Platform (GCP) (Google Australia Pty Ltd.) | Cloud infrastructure for storing and processing customer data in Parquet format | Parquet storage and processing for analytics | Customer Data and files/objects (Parquet) | Primary storage and processing in the same cloud region as the customer’s data warehouse; country varies by customer | Analytics features |
| Amazon Web Services (AWS) (Amazon Web Services Australia Pty Ltd) | Cloud infrastructure for storing and processing customer data in Parquet format | Parquet storage and processing for analytics | Customer Data and files/objects (Parquet) | Primary storage and processing in the same cloud region as the customer’s data warehouse; country varies by customer | Analytics features |
| Supabase Inc. | Authentication, database, and storage | User authentication, application database, file/object storage | Account data, authentication identifiers, workspace data, Customer Data, files/objects, and logs | United States of America (Bounty’s primary project data store); Supabase subprocessors may process data in the United States of America and Singapore | Core service |
| Vercel, Inc. | Hosting and processing for the Bounty app and workflows | Web app hosting, deployments, routing, serverless/edge processing | User requests, IP/device data, app data in transit, logs, environment variables, and secrets | United States of America (primary); other locations may apply based on Bounty’s deployment configuration and Vercel subprocessors | Core service |
| Trigger.dev (API Hero Ltd) | Background job orchestration and managed task execution | Scheduled and asynchronous notebook, dataset, attribution, integration sync, and workflow tasks | Task payloads and tags, organization/dataset/notebook/model/run identifiers, Customer Data accessed or transformed during execution, task outputs, logs, errors, and execution metadata | United Kingdom and United States of America; Trigger.dev subprocessors may also process data in the European Union | Core background processing |
| Temporal Cloud (Temporal Technologies Inc.) | Durable workflow orchestration for background data processing, including data synchronisation and import workflows | Dataset sync jobs and regional Stream imports | Organization, job, and run identifiers, execution status and timing, references to stored inputs and outputs, and destination storage identifiers for Stream imports | Australia (Sydney, AWS) or United States of America (Iowa, GCP), according to the customer’s cloud and region; Temporal’s authentication subprocessors also process data in the United States of America | Core service |
| Airbyte | Source and data integrations | Customer-authorized connector syncs and integration data movement | Source credentials/tokens, schema metadata, synced records, sync logs, and configuration metadata | United States of America (Airbyte control plane; data-plane country is configured per connection). France if a connection uses Airbyte’s EU data plane | Integration-dependent |
| OpenAI | AI inference | Customer-visible chat, agents, analysis, summarization, and generated actions | Prompts, de-identified Customer Data included in prompts, outputs, and usage metadata | OpenAI OpCo, LLC: United States of America. OpenAI service subprocessors may process Customer Data in Australia, Brazil, Canada, Finland, France, Germany, India, Indonesia, Ireland, Italy, Japan, Malaysia, Mexico, Netherlands, Norway, Philippines, Poland, Singapore, South Africa, South Korea, Spain, Sweden, Switzerland, United Arab Emirates, United Kingdom, and the United States of America | AI features; submitted customer data is not used to train OpenAI’s general models |
| Anthropic | AI inference | Customer-visible analysis, agent, and language-model workflows where enabled | Prompts, de-identified Customer Data included in prompts, outputs, and usage metadata | United States of America (data storage). Anthropic may also process Customer Data in selected countries in Europe, Asia, and Australia; its public direct-API disclosure does not provide a country-by-country list | AI features; submitted customer data is not used to train Anthropic’s general models |
| E2B | Sandboxed code execution | Isolated code execution for analysis or workflow tasks | Code, inputs, customer-provided data, generated files, logs, and execution outputs | United States of America | Analysis features |
| ClickHouse | Analytics warehouse | Storage and querying of analytics/customer data | Customer source data, transformed analytics data, query results, schemas, metadata, and logs | United States of America (Bounty’s analytics cluster and ClickHouse control plane); Australia, Germany, India, Japan, the Netherlands, Singapore, and the United Kingdom through ClickHouse affiliates that may provide technical or support services | Analytics features |
| PostHog | Product analytics and session recording | Product usage analytics, events, funnels, and session replay where enabled | User identifiers, product events, device/session metadata, page interactions, and recordings where enabled | United States of America (PostHog US Cloud) or Germany (PostHog EU Cloud), according to Bounty’s project region | Product analytics |
| Sentry | Error monitoring | Error capture, diagnostics, stack traces, logs, and performance context | Error events, stack traces, request context, user identifiers if configured, source maps, and logs | United States of America and Germany (Sentry product infrastructure); Canada, Austria, and the Netherlands through Sentry group companies | Monitoring |
| Resend | Email delivery | Transactional email delivery and email-related notifications | Recipient email addresses, names, message content, delivery metadata, and bounce/open/click data where enabled | United States of America (primary processing and account data). Ireland if Bounty selects Resend’s EU sending region | Email delivery |
Customer-Configured Integrations
These are customer-configured data sources. Bounty reads data from the customer-authorized accounts and does not direct these providers to process Customer Data on Bounty’s behalf.| Data source / integration | Purpose | Product function | Categories of data processed | Countries where data may be processed | Use |
|---|---|---|---|---|---|
| Snowflake | Customer-configured warehouse integration | Connect to selected warehouse tables and make curated data sources available in Bounty | Warehouse credentials/tokens, schemas, table names, selected warehouse records, query results, and metadata | Determined by the customer’s Snowflake account, warehouse region, and Bounty access path | Optional / customer-configured |
| Tinybird | Customer-configured analytics integration | Connect to available Tinybird tables and make curated data sources available in Bounty | API tokens, schemas, table names, records, query results, and metadata | Determined by the customer’s Tinybird account and Bounty access path | Optional / customer-configured |
| GA4 | Customer-configured analytics source | Authorize GA4, select properties, and support activated customer data workflows | Property metadata and, when activated, analytics dimensions, metrics, identifiers, conversion data, and reporting data | Determined by Google processing locations and the customer’s GA4 configuration | Optional / customer-configured |
| Google Play | Customer-configured app-store analytics source | Read store visitors, acquisitions, and performance reporting from authorized developer accounts | Store performance data, app identifiers, country-level metrics, and reporting metadata | Determined by Google processing locations and the customer’s Google Play configuration | Optional / customer-configured |
| Meta Ads | Customer-configured advertising source | Connect campaign, ad set, ad, and daily performance tables | Campaign/ad performance data, account identifiers, audience/reporting metadata, and conversion data | Determined by Meta processing locations and the customer’s account configuration | Optional / customer-configured |
| Snapchat Ads | Customer-configured advertising source | Read campaign and daily advertising performance from authorized advertiser accounts | Account identifiers, campaign data, performance metrics, attribution settings, and reporting metadata | Determined by Snap processing locations and the customer’s account configuration | Optional / customer-configured |
| Microsoft Advertising | Customer-configured advertising source | Read campaign, ad group, keyword, and performance reporting data from authorized advertiser accounts | Account identifiers, campaign/ad group/keyword data, performance metrics, and conversion reporting data | Determined by Microsoft processing locations and the customer’s account configuration | Optional / customer-configured |
| Criteo | Customer-configured advertising source | Read campaign and performance reporting data from authorized advertiser accounts | Account identifiers, campaign data, performance metrics, reporting metadata, and conversion data | Determined by Criteo processing locations and the customer’s account configuration | Optional / customer-configured |
| HubSpot | Customer-configured CRM/source integration | Connect CRM or lifecycle data for analysis and data sources | Contact/company/deal data, lifecycle fields, interaction metadata, and identifiers | Determined by HubSpot processing locations and the customer’s account configuration | Optional / customer-configured |
| Google Ads | Customer-configured advertising source | Authorize Google Ads, select advertiser accounts, and support activated customer data workflows | Account metadata and, when activated, campaign, keyword/ad, conversion, and reporting data | Determined by Google processing locations and the customer’s account configuration | Optional / customer-configured |
| Google Search Console | Customer-configured search analytics source | Authorize read-only Search Console access, select domain or URL-prefix properties, and synchronize finalized daily search performance | Property identifiers, query and canonical page dimensions, clicks, impressions, click-through rate, and average position | Determined by Google processing locations and the customer’s Search Console configuration | Optional / customer-configured |
| Customer.io | Customer-configured lifecycle/customer engagement source | Connect lifecycle, messaging, or customer event data | Contact profiles, event data, message metadata, and segments | Determined by Customer.io processing locations and the customer’s account configuration | Optional / customer-configured |
| Apple Search Ads | Customer-configured advertising source | Connect campaign and app advertising performance data | Campaign/ad group/keyword performance, attribution data, and account identifiers | Determined by Apple processing locations and the customer’s account configuration | Optional / customer-configured |
| Apple App Store Connect | Customer-configured app-store analytics source | Read App Store impressions, taps, page views, downloads, and performance reporting from authorized developer accounts | App identifiers, store performance data, acquisition metrics, and reporting metadata | Determined by Apple processing locations and the customer’s App Store Connect configuration | Optional / customer-configured |
| Adjust | Customer-configured mobile measurement source | Read mobile attribution apps and reporting data from authorized customer accounts | App identifiers, attribution and acquisition data, campaign performance data, and reporting metadata | Determined by Adjust processing locations and the customer’s account configuration | Optional / customer-configured |