Sub-processor List

Live document. Last updated Sept 7, 2026

This page lists the third-party sub-processors that Myner AG engages to process personal data of Members in connection with the Myner Service. Myner remains responsible for sub-processor compliance under our Privacy Policy and the applicable Data Processing Addenda. This list is maintained on an ongoing basis; the current version always governs.

Myner AG  •  Gartenstrasse 6, 6300 Zug, Switzerland  •  CHE-202.314.864

Current sub-processors

DATABASE, AUTHENTICATION, STORAGE (PRIMARY DATA STORE)

Supabase, Inc.

Data categories: Account, profile, receipts, transactions, survey responses, derived attributes

Processing region: Germany (eu-central-1, Frankfurt)

Transfer mechanism: Swiss-amended SCCs (per executed DPA)

DPA status: Executed

CLOUD HOSTING AND INFRASTRUCTURE

Amazon Web Services, Inc. (EEA contracting: AWS EMEA SARL)

Data categories: Underlying infrastructure for primary data store and direct services; all member data categories

Processing region: Germany (Frankfurt, eu-central-1)

Transfer mechanism: SCCs incorporated in AWS Service Terms; DPF-certified

DPA status: Incorporated

RECEIPT OCR AND PROCESSING

Google LLC (ML Kit, Gemini); Amazon Web Services, Inc.; Supabase, Inc.

Data categories: Receipt images, extracted line items, merchant and product data

Processing region: Germany (EU regions for Google and AWS); Supabase as above

Transfer mechanism: SCCs / DPF (Google, AWS); per Supabase DPA

DPA status: Incorporated (Google, AWS); executed (Supabase)

LLM / AI API

Google LLC (Gemini)

Data categories: Receipt content and derived text inputs

Processing region: Germany / EU endpoints

Transfer mechanism: SCCs / DPF

DPA status: Incorporated

IDENTITY VERIFICATION AND FRAUD DETECTION

Cloudflare, Inc. (Turnstile); Supabase, Inc.

Data categories: Device signals, IP address, account identifiers

Processing region: Global edge (Cloudflare); Supabase as above

Transfer mechanism: SCCs / DPF

DPA status: Incorporated (Cloudflare); executed (Supabase)

Role: Dual role. Cloudflare acts as our processor, on our instructions, to detect and block bot and abusive traffic on our web surfaces. Cloudflare also processes the same technical request signals as an independent controller to improve its own bot-detection product across its customer base; that use is governed by Cloudflare's own terms and is not directed by Myner.

DATA CLEANROOM

Supabase, Inc.

Data categories: Hashed identifiers and member attributes made available for matched-audience products

Processing region: Germany (eu-central-1, Frankfurt)

Transfer mechanism: Per executed Supabase DPA

DPA status: Executed

PUSH NOTIFICATIONS

OneSignal, Inc.

Data categories: Push subscription token, device identifiers, app event triggers (notification content excludes consumer health data)

Processing region: EU (Netherlands, europe-west4 per OneSignal infrastructure); global delivery edge

Transfer mechanism: Swiss-amended SCCs

DPA status: Incorporated

MOBILE APP ANALYTICS (ANDROID)

Google LLC (Google Analytics for Firebase)

Data categories: App and device identifiers, app events, screen-view events (consumer-health-data screens excluded; precise location stripped)

Processing region: United States

Transfer mechanism: SCCs / DPF

DPA status: Incorporated

CRYPTO REDEMPTION

thirdweb, Inc.

Data categories: Wallet address, redemption metadata

Processing region: United States

Transfer mechanism: SCCs

DPA status: Incorporated

EMAIL AND COMMUNICATIONS

Amazon Web Services, Inc. (SES); Google LLC; Chatwoot Inc.

Data categories: Email address, message content, support ticket data

Processing region: Germany (AWS, Google EU); Chatwoot per its DPA

Transfer mechanism: SCCs / DPF (AWS, Google); Chatwoot per its DPA.

DPA status: Incorporated

MOBILE ANALYTICS, SESSION REPLAY, ERROR AND CRASH TRACKING

Functional Software, Inc. d/b/a Sentry; PostHog Inc.

Data categories: Opaque member identifier, app events, crash and performance data (consumer-health-data screens excluded; precise location stripped)

Processing region: EU regions

Transfer mechanism: SCCs

DPA status: Incorporated

CONSENT MANAGEMENT (WEBSITE)

Termly, Inc.

Data categories: Cookie and banner consent (website only)

Processing region: United States

Transfer mechanism: SCCs

DPA status: Incorporated

REWARD PAYOUTS (GIFT CARD / FIAT)

Tremendous, LLC

Data categories: Member name, email address, payout method and redemption details, reward transaction metadata

Processing region: United States

Transfer mechanism: Swiss-amended SCCs / EU SCCs with UK Addendum

DPA status: Incorporated

SURVEYS AND FORMS

Formester, Inc.

Data categories: Survey responses, form submissions, associated Member identifiers and email address

Processing region: United States

Transfer mechanism: SCCs (per Formester DPA)

DPA status: Incorporated

MOBILE ATTRIBUTION AND MARKETING ANALYTICS

AppsFlyer Ltd.

Data categories: Device and app identifiers, IP address, app install and in-app events, attribution data (precise location stripped; consumer-health-data events excluded)

Processing region: EU (AWS / Google Cloud EU regions)

Transfer mechanism: EU/Swiss adequacy decision (Israel); SCCs for onward transfers

DPA status: Incorporated

TRANSACTIONAL AND PRODUCT-ANNOUNCEMENT EMAIL

Plus Five Five, Inc. (d/b/a Resend)

Data categories: Email address, username, locale, timezone, signup date, account role, referral flag; transactional and product-announcement email content

Processing region: United States

Transfer mechanism: Swiss-amended SCCs (per Resend DPA); EU-US Data Privacy Framework participant

DPA status: Incorporated

Functions not currently engaged

Open Banking intermediary and data breach cross-reference API are not currently engaged. Members will be notified, and this list updated, before any such sub-processor begins processing personal data.

Notes

In-app consent. In-app consent is managed internally by Myner; no third-party sub-processor is involved. Website cookie and banner consent is handled by Termly, Inc. (above).

Onward sub-processors. Certain sub-processors engage their own onward sub-processors to deliver their services to Myner, including Supabase, Inc. (supabase.com/legal/subprocessors), AppsFlyer Ltd. (appsflyer.com/legal/subprocessors), Formester, Inc. (Heroku/AWS, Cloudflare, Stripe), Tremendous, LLC (published sub-processor list) and Plus Five Five, Inc. d/b/a Resend (resend.com/legal/subprocessors). Each such list is incorporated here by reference.

Notice of changes. Myner will provide notice of any new sub-processor before it begins processing personal data, in accordance with the Privacy Policy and applicable law.

Contact. privacy@mynerapp.com

Change log

June 22, 2026 — Initial publication.

August 16, 2026 — Added Tremendous, LLC (reward payouts); Formester, Inc. (surveys and forms); AppsFlyer Ltd. (mobile attribution and marketing analytics).

September 1, 2026 — Added Plus Five Five, Inc. (d/b/a Resend) (transactional and product-announcement email).

September 7, 2026 — Identified Cloudflare, Inc. (Turnstile) as acting in a dual role (processor and independent controller) for bot and abuse detection.