CountaBill
Subprocessors
Last updated: 27 August 2026
Logical Solutions Innovations (Pty) Ltd uses the following third-party subprocessors to operate CountaBill and this website. Each processes data on our behalf under contractual data protection obligations.
They are listed per service rather than per company, because that is the level at which it matters: Crashlytics receives a stack trace, Analytics receives a pseudonymous identifier, and Gemini receives the receipt image itself. Grouping them under one company name would hide exactly the distinction you are entitled to see.
Active subprocessors
| Subprocessor | Purpose | Data processed | Location | Transfer |
|---|---|---|---|---|
| Google LLC Firebase Authentication |
User sign-up and sign-in | Email, password hash, Firebase UID, sign-in provider, last-login timestamp | US (multi-region) | 1 |
| Google LLC Cloud Firestore |
Primary application database | Budgets, transactions, categories, income, debts, receipt metadata, consent records, quotas | us-central1 (US) |
1 |
| Google LLC Cloud Storage |
Receipt and warranty images, training copies | Compressed JPEG images; anonymised training copies with Gaussian-blurred personal details | us-central1 (US) |
1 |
| Google LLC Cloud Functions |
OCR orchestration, account deletion, training anonymisation | Transient only: images, extracted text, user ID | us-central1 (US) |
1 |
| Google LLC Gemini API (paid tier) |
Receipt OCR and detection of personal details | Transient receipt image and prompt. Not retained by Google and not used to train Google models, under the paid-tier contract | US | 1 |
| Google LLC Firebase Cloud Messaging |
Push notifications | Device token, notification payload | US | 1 |
| Google LLC Firebase Crashlytics |
Crash diagnostics | Stack traces, device model, OS and app version. No financial or personal data by configuration | US | 1 |
| Google LLC Firebase Analytics |
Usage analytics (opt-in, off by default) | Pseudonymous app-instance ID, event names, screen views | US | 1 |
| Google LLC Firebase App Check |
Anti-abuse device attestation | Attestation token, app instance ID | US | 1 |
| Google LLC Firebase Remote Config |
Feature flags and kill switches | Non-personal configuration only | US | 1 |
| Google LLC Google Workspace |
Company email (support, privacy, DPO mailboxes) | Email content you address to us | US / multi-region | 1 |
| Apple Inc. Sign in with Apple |
Authentication (optional) | Apple relay email, opaque user ID | US | 2 |
| Apple Inc. Apple Push Notification service |
iOS push delivery | APNs token, notification payload | US | 2 |
| Cloudflare, Inc. Pages / Workers / DNS |
Hosting and DNS for this marketing website | Website visitor IP address, transiently in logs. No CountaBill app data | Global anycast | 3 |
| OpenStreetMap Foundation Nominatim geocoder |
Resolving a merchant name to a store location, so a slip can be tied to the branch it came from | Merchant name as read off the receipt; an approximate device position (biasing box around 50 km, so a city rather than an address) where available; ISO country code. No account identifier, no amounts, no other receipt contents | United Kingdom / EU | 4 |
| EU representative (to be appointed) | Article 27 GDPR representative for EU/EEA users | Contact details of data subjects who write to the representative | European Union | — |
| UK representative (to be appointed) | Article 27 UK GDPR representative for UK users | Contact details of data subjects who write to the representative | United Kingdom | — |
Transfer mechanisms
- Google LLC. Standard Contractual Clauses (2021) Module 2, Controller to Processor, as incorporated in the Google Cloud Data Processing Addendum. UK transfers additionally rely on the UK International Data Transfer Agreement (IDTA) Addendum. Privacy policy: policies.google.com/privacy.
- Apple Inc. Standard Contractual Clauses under the Apple Developer Agreement and Apple's data processing terms, where applicable. Privacy policy: apple.com/legal/privacy.
- Cloudflare, Inc. Standard Contractual Clauses via the Cloudflare Data Processing Addendum. Privacy policy: cloudflare.com/privacypolicy.
- OpenStreetMap Foundation. No transfer safeguard is required: the Foundation is established in the United Kingdom, which holds a European Commission adequacy decision. Privacy policy: OSMF Privacy Policy.
Changes to this list
We will update this page when subprocessors are added or removed. Material changes will be reflected in our Privacy Policy.
Contact
Questions about subprocessors: support-budget.app@logicalsolutionsinnovations.com