DRAFT — pending attorney review. An attorney has not reviewed this document yet, and it may change before its final version.
Subprocessors
Version 0.2.0. In effect since October 3, 2026.
| Version | 0.2.0 |
| Effective date | October 3, 2026 |
| Controller | Osvaldo Rodriguez (an individual) |
| Contact | tripsettled.app@gmail.com |
The short version
- Today only Microsoft processes your data on our behalf: it hosts the app, the database and files, sends emails and stores technical logs, in the United States.
- Google only takes part if you choose to sign in with Google (to confirm who you are) or if you write to our email, which is a Gmail account.
- GitHub and GoDaddy provide services to us, but they don't receive your personal data.
- Before a new provider processes your data, we will update this list and let you know.
1. What a subprocessor is
A company that processes personal data on our behalf to provide a service to us, for example hosting the database. It may only use the data to provide that service, following our instructions and a data protection agreement. Mexican law calls it an “encargado”.
2. Providers that process your data today
| Provider | What we use it for | What data it processes | Where | Safeguards |
|---|---|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Hosting the app (Azure Container Apps), the database (Azure Database for PostgreSQL), files (Azure Blob Storage) and secrets (Azure Key Vault); sending emails (Azure Communication Services Email); technical logs and monitoring (Azure Monitor, Log Analytics and Application Insights) | All app data: account, sessions, trips, emails we send you, technical logs and telemetry | United States (South Central US region, in Texas). Emails are processed in the United States. Some components may process data in transit in other regions. | Microsoft Products and Services Data Protection Addendum (DPA) |
3. Providers that only take part if you choose them
| Provider | What for | What data | How it works |
|---|---|---|---|
| Google LLC (Sign in with Google) | Signing in with your Google account | Google sends us your Google identifier, your email, whether it's verified, and your name | Google confirms your identity under its own privacy policy; in this step it doesn't act on our behalf. We don't send it any trip data. If you don't choose to sign in with Google, Google isn't involved. |
| Google LLC (Gmail) | Receiving and answering the messages you send to tripsettled.app@gmail.com, including privacy requests | What you write to us: your email, your name, your message and any attachments, and our replies | It's a Gmail account. Google stores the messages on its own servers, in several countries, under its terms and privacy policy; for this service it doesn't offer a processor agreement. If you don't email us, it isn't involved: most of your rights can be exercised from My account. |
4. Providers that don't receive your personal data
| Provider | What for |
|---|---|
| GitHub, Inc. | Storing the source code and running automated tests and deployments. It only uses made-up test data, never user data. |
| GoDaddy | Registration of the tripsettled.com domain and its DNS (the “address book” that points the domain to our servers). |
5. Planned providers
They aren't active yet and don't receive any data. Before turning them on, we will check their terms, update this list and let you know.
| Provider | What for | When |
|---|---|---|
| Anthropic, PBC (Claude API) | AI booking import and suggestions (see the AI Use Policy) | AI phase |
| Google Maps Platform | Routes, travel times and places | Later phases |
| Open-Meteo | Weather forecasts | Later phases |
| Frankfurter | Exchange rates | Expenses phase |
| NREL and Open Charge Map | Electric vehicle charging stations | Later phases |
| AeroDataBox | Flight status | Later phases |
For several of these services we would only send data that doesn't identify you, such as a destination's coordinates, a date or a currency. When we turn them on, this list will say whether they receive personal data.
6. Changes to this list
Before a new subprocessor starts processing your personal data, we will publish the new version of this list and let you know in the app. If you don't agree, you can export your data and delete your account.
Change history
| Version | Date | Change |
|---|---|---|
| 0.2.0 | 2026-10-03 | Before taking effect: the controller, and Google (Gmail) for the messages you email us. |
| 0.1.0 | 2026-10-03 | First list: Microsoft (including Azure Communication Services Email), Google (sign-in only), GitHub and GoDaddy (no personal data), and planned providers. |