Sub-processor List

Live document. Last updated Sept 1, 2026

This page lists the third-party sub-processors that Myner AG engages to process personal data of Members in connection with the Myner Service. Myner remains responsible for sub-processor compliance under our Privacy Policy and the applicable Data Processing Addenda. This list is maintained on an ongoing basis; the current version always governs.

Myner AG  •  Gartenstrasse 6, 6300 Zug, Switzerland  •  CHE-202.314.864

Current sub-processors

DATABASE, AUTHENTICATION, STORAGE (PRIMARY DATA STORE)

Supabase, Inc.

Data categories: Account, profile, receipts, transactions, survey responses, derived attributes

Processing region: Germany (eu-central-1, Frankfurt)

Transfer mechanism: Swiss-amended SCCs (per executed DPA)

DPA status: Executed

CLOUD HOSTING AND INFRASTRUCTURE

Amazon Web Services, Inc. (EEA contracting: AWS EMEA SARL)

Data categories: Underlying infrastructure for primary data store and direct services; all member data categories

Processing region: Germany (Frankfurt, eu-central-1)

Transfer mechanism: SCCs incorporated in AWS Service Terms; DPF-certified

DPA status: Incorporated

RECEIPT OCR AND PROCESSING

Google LLC (ML Kit, Gemini); Amazon Web Services, Inc.; Supabase, Inc.

Data categories: Receipt images, extracted line items, merchant and product data

Processing region: Germany (EU regions for Google and AWS); Supabase as above

Transfer mechanism: SCCs / DPF (Google, AWS); per Supabase DPA

DPA status: Incorporated (Google, AWS); executed (Supabase)

LLM / AI API

Google LLC (Gemini)

Data categories: Receipt content and derived text inputs

Processing region: Germany / EU endpoints

Transfer mechanism: SCCs / DPF

DPA status: Incorporated

IDENTITY VERIFICATION AND FRAUD DETECTION

Cloudflare, Inc. (Turnstile); Supabase, Inc.

Data categories: Device signals, IP address, account identifiers

Processing region: Global edge (Cloudflare); Supabase as above

Transfer mechanism: SCCs / DPF

DPA status: Incorporated (Cloudflare); executed (Supabase)

DATA CLEANROOM

Supabase, Inc.

Data categories: Hashed identifiers and member attributes made available for matched-audience products

Processing region: Germany (eu-central-1, Frankfurt)

Transfer mechanism: Per executed Supabase DPA

DPA status: Executed

PUSH NOTIFICATIONS

OneSignal, Inc.

Data categories: Push subscription token, device identifiers, app event triggers (notification content excludes consumer health data)

Processing region: EU (Netherlands, europe-west4 per OneSignal infrastructure); global delivery edge

Transfer mechanism: Swiss-amended SCCs

DPA status: Incorporated

MOBILE APP ANALYTICS (ANDROID)

Google LLC (Google Analytics for Firebase)

Data categories: App and device identifiers, app events, screen-view events (consumer-health-data screens excluded; precise location stripped)

Processing region: United States

Transfer mechanism: SCCs / DPF

DPA status: Incorporated

CRYPTO REDEMPTION

thirdweb, Inc.

Data categories: Wallet address, redemption metadata

Processing region: United States

Transfer mechanism: SCCs

DPA status: Incorporated

EMAIL AND COMMUNICATIONS

Amazon Web Services, Inc. (SES); Google LLC; Chatwoot Inc.

Data categories: Email address, message content, support ticket data

Processing region: Germany (AWS, Google EU); Chatwoot per its DPA

Transfer mechanism: SCCs / DPF (AWS, Google); Chatwoot per its DPA.

DPA status: Incorporated

MOBILE ANALYTICS, SESSION REPLAY, ERROR AND CRASH TRACKING

Functional Software, Inc. d/b/a Sentry; PostHog Inc.

Data categories: Opaque member identifier, app events, crash and performance data (consumer-health-data screens excluded; precise location stripped)

Processing region: EU regions

Transfer mechanism: SCCs

DPA status: Incorporated

CONSENT MANAGEMENT (WEBSITE)

Termly, Inc.

Data categories: Cookie and banner consent (website only)

Processing region: United States

Transfer mechanism: SCCs

DPA status: Incorporated

REWARD PAYOUTS (GIFT CARD / FIAT)

Tremendous, LLC

Data categories: Member name, email address, payout method and redemption details, reward transaction metadata

Processing region: United States

Transfer mechanism: Swiss-amended SCCs / EU SCCs with UK Addendum

DPA status: Incorporated

SURVEYS AND FORMS

Formester, Inc.

Data categories: Survey responses, form submissions, associated Member identifiers and email address

Processing region: United States

Transfer mechanism: SCCs (per Formester DPA)

DPA status: Incorporated

MOBILE ATTRIBUTION AND MARKETING ANALYTICS

AppsFlyer Ltd.

Data categories: Device and app identifiers, IP address, app install and in-app events, attribution data (precise location stripped; consumer-health-data events excluded)

Processing region: EU (AWS / Google Cloud EU regions)

Transfer mechanism: EU/Swiss adequacy decision (Israel); SCCs for onward transfers

DPA status: Incorporated

TRANSACTIONAL AND PRODUCT-ANNOUNCEMENT EMAIL

Plus Five Five, Inc. (d/b/a Resend)

Data categories: Email address, username, locale, timezone, signup date, account role, referral flag; transactional and product-announcement email content

Processing region: United States

Transfer mechanism: Swiss-amended SCCs (per Resend DPA); EU-US Data Privacy Framework participant

DPA status: Incorporated

Functions not currently engaged

Open Banking intermediary and data breach cross-reference API are not currently engaged. Members will be notified, and this list updated, before any such sub-processor begins processing personal data.

Notes

In-app consent. In-app consent is managed internally by Myner; no third-party sub-processor is involved. Website cookie and banner consent is handled by Termly, Inc. (above).

Onward sub-processors. Certain sub-processors engage their own onward sub-processors to deliver their services to Myner, including Supabase, Inc. (supabase.com/legal/subprocessors), AppsFlyer Ltd. (appsflyer.com/legal/subprocessors), Formester, Inc. (Heroku/AWS, Cloudflare, Stripe), Tremendous, LLC (published sub-processor list) and Plus Five Five, Inc. d/b/a Resend (resend.com/legal/subprocessors). Each such list is incorporated here by reference.

Notice of changes. Myner will provide notice of any new sub-processor before it begins processing personal data, in accordance with the Privacy Policy and applicable law.

Contact. privacy@mynerapp.com

Change log

June 22, 2026 — Initial publication.

August 16, 2026 — Added Tremendous, LLC (reward payouts); Formester, Inc. (surveys and forms); AppsFlyer Ltd. (mobile attribution and marketing analytics).

September 1, 2026 — Added Plus Five Five, Inc. (d/b/a Resend) (transactional and product-announcement email).