Sub-processors
These companies process personal data for us to run Bouncing Bison. For each one you can see what it does for us, which data it handles and where the processing takes place, as far as our own configuration determines it.
We announce any new or replacement sub-processor on this page at least 30 days before it starts processing personal data. Providers who have accepted our Data Processing Addendum can object during that period, as the addendum describes.
Fly.io
- What it does for us
- Runs the Bouncing Bison application servers.
- Data involved
- All data the application handles while it processes a request, including account, booking and message data.
- Where
- Frankfurt, Germany (Fly.io region fra).
Fly.io Managed Postgres
- What it does for us
- The main database.
- Data involved
- Accounts, listings, bookings, messages, reviews, notifications and consent records.
- Where
- Frankfurt, Germany (Fly.io region fra).
Upstash Redis (via Fly.io)
- What it does for us
- Shares rate limit counters between our servers and passes chat messages from one server to another.
- Data involved
- IP addresses in rate limit counters, which expire within an hour, and chat messages while they are being delivered.
- Where
- Frankfurt, Germany (Fly.io region fra).
Cloudflare R2
- What it does for us
- Stores uploaded photos and avatars, and an archive copy of consent records in a separate private bucket.
- Data involved
- Photos and avatars you upload; consent records (email address, IP address, browser, time and the version accepted).
- Where
- European Union (Cloudflare R2 EU jurisdiction).
Cloudflare DNS
- What it does for us
- DNS for our domains, and the redirect from our former address marovel.co to bouncingbison.com.
- Data involved
- For visitors of the former address: IP address, browser details and the requested page.
- Where
- Cloudflare's global network, usually the data centre nearest to the visitor.
Stripe
- What it does for us
- Membership payments, invoices and the billing portal for providers.
- Data involved
- Provider email address and user ID, subscription status, and the card and billing details you enter on Stripe's own pages. We never receive card numbers.
- Where
- Chosen by the provider, not by our configuration. This may include countries outside the EEA, such as the United States.
Brevo
- What it does for us
- Sends transactional email: password resets, booking updates, reminders, membership notices and account deletion confirmations.
- Data involved
- Recipient email address and the content of the email, which can include names, booking details and one-time links.
- Where
- Chosen by the provider, not by our configuration. This may include countries outside the EEA.
Mapbox
- What it does for us
- Shows maps on listings and on the map page. The map loads directly from Mapbox in your browser.
- Data involved
- Your IP address, browser details and the map area you look at.
- Where
- Chosen by the provider, not by our configuration. This may include countries outside the EEA, such as the United States.
Transfers outside the EEA
Where a company on this page processes personal data outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission or on the Commission's Standard Contractual Clauses, as offered by that company.
Other services you may use
These services are not our processors. They act on their own account, under their own privacy policies, and only come into play when you use them.
- Google, if you choose Sign in with Google. Google sends us your name, email address and account ID.
- Apple, if you choose Sign in with Apple. Apple sends us your account ID and the name and email address you agree to share.
- YouTube and Vimeo, when a listing includes a video. For YouTube, the preview image loads from YouTube's image server (i.ytimg.com), and the player loads from youtube-nocookie.com only after you click play. A Vimeo video loads the Vimeo player together with the page.
Last updated: 2026-09-29 · Privacy Policy · Data Processing Addendum