This page lists the companies that process personal data for Appsium. It is the sub-processor list referred to in our Data Processing Addendum and Privacy Policy.
1. Sub-processors for customer data
These providers may process the personal data in your workspace that we handle on your behalf (“Customer Personal Data” in the DPA), such as reviewer nicknames, review text and the content you upload.
| Provider | What it does for us | Data involved | Location | Transfer safeguard |
|---|---|---|---|---|
| Google Cloud Google Cloud EMEA Limited, Ireland | Hosting of the application, database, file storage, encryption keys, secrets, logs, backups, and the CDN for appsium.page | All workspace content and account data | EU (Belgium, europe-west1) | Data stays in the EU. Google Cloud Data Processing Addendum with standard contractual clauses for any access from outside the EU |
| OpenAI OpenAI OpCo, LLC, USA | AI text generation and analysis, visual analysis of screenshots, some image generation, moderation of hosted pages | The content needed for the AI feature you run: briefs, metadata, keywords, screenshots, pre-review answers, review rating and text. Not reviewer nicknames, Apple keys or demo credentials | USA | OpenAI Data Processing Addendum with standard contractual clauses. No training on API data |
| Google (Gemini API) Google LLC, USA | AI image generation and enhancement for screenshots and logos | Prompts built from your brief, and the screenshots or images you choose as input | USA and other Google locations | Google data processing terms with standard contractual clauses. No training on paid API data |
| Resend Plus Five Five, Inc., USA | Delivery of alert emails | Your email address and the alert content, which for review alerts includes the reviewer nickname, rating and review text | USA (sending region: EU, Ireland) | Resend Data Processing Addendum with standard contractual clauses |
2. Other service providers
These providers process personal data for which Appsium is the controller, such as account, sign-in, billing and analytics data. They are not sub-processors of customer data.
| Provider | What it does for us | Data involved | Location |
|---|---|---|---|
| Firebase Authentication Google LLC, USA | Sign-in with Google, Apple or GitHub | Email address, name, profile photo, sign-in provider ID, IP address | USA |
| Firebase Hosting Google LLC, USA | Serving the appsium.io website | IP address and request data of website visitors | Global edge network |
| Resend Plus Five Five, Inc., USA | Delivery of sign-in code emails | Email address and the one-time code | USA (sending region: EU, Ireland) |
| Google Workspace Google Cloud EMEA Limited, Ireland | Support and business email | Your messages to us and your email address | EU and USA |
| Google Analytics 4 Google Ireland Limited / Google LLC | Website and portal usage statistics, only with your consent | Cookie ID, IP address, device and usage data | EU and USA |
| DataForSEO DataForSEO OÜ, Estonia | Search volume data for keyword research | Keywords and country code only. No personal data | EU |
3. Independent third parties
These companies receive data as controllers in their own right, or because you chose to connect them. Their own terms and privacy policies apply.
| Company | Role | Data involved |
|---|---|---|
| Paddle Paddle.com Market Limited, UK, and its affiliates | Merchant of Record: sells subscriptions and credit packs, processes payments, tax, invoices and refunds as an independent controller | Your email address, billing and payment details that you give to Paddle at checkout, and an internal Appsium account ID |
| Apple Apple Inc., USA, and Apple Distribution International Ltd., Ireland | Operates App Store Connect, Apple Ads, the App Store and the iTunes Search API. We call these on your instructions with your own keys, and look up public App Store data | Your API credentials (as signed requests), the metadata and review replies you send, and your IP address for lookups made from your browser |
| Sign-in providers Google, Apple, GitHub | Confirm your identity when you choose social sign-in | The fact that you signed in to Appsium |
| Slack (if you connect it) | Receives the review and competitor alerts you route to your own workspace | Alert content, including reviewer nickname and review text |
| AI assistants (if you connect one through MCP) | Read your Appsium data at your request | Apps, keyword ranks, reviews, review themes, competitor changes, pre-review findings |
| YouTube Google Ireland Limited | Plays the product video on appsium.io after you click it | IP address and device data |
4. Changes to this list
Before a new sub-processor starts processing customer data, we update section 1 of this page at least 30 days in advance. The date at the top of the page shows the last change. You can object within 30 days of the update by emailing support@appsium.io, as described in section 7 of the DPA. Changes to sections 2 and 3 are made here without advance notice.