Sub-processors

The third-party providers ("sub-processors" under Art. 28 GDPR) that process personal data on behalf of Tomorrow Tech S.r.l. to deliver the Amperry services. The list reflects the services actually integrated into the product.

Infrastructure & hosting

Google Firebase / Google Cloud

• Entity: Google Ireland Limited
• Purpose: Core cloud infrastructure: database (Cloud Firestore), account authentication, file storage (Cloud Storage), serverless functions (Cloud Functions / Cloud Run), web hosting and anti-abuse protection (App Check).
• Data processed: Account and profile data, credentials, uploaded content, rental and usage data, technical identifiers.
• Location: EU / EEA (with possible extra-EU transfers under safeguards)
• Provider privacy policy

Google Cloud Messaging (FCM)

• Entity: Google Ireland Limited
• Purpose: Delivery of push notifications to the Amperry app.
• Data processed: Device push token, notification content.
• Location: EU / EEA (with possible extra-EU transfers under safeguards)
• Provider privacy policy

Google Maps Platform

• Entity: Google Ireland Limited
• Purpose: Rendering the station map and locating nearby stations.
• Data processed: Approximate or precise device location.
• Location: EU / EEA (with possible extra-EU transfers under safeguards)
• Provider privacy policy

Google reCAPTCHA e Google Fonts

• Entity: Google Ireland Limited
• Purpose: Web anti-abuse protection (reCAPTCHA, via App Check) and delivery of typographic fonts (Google Fonts).
• Data processed: IP address, user-agent, interaction signals for bot detection.
• Location: EU / EEA (with possible extra-EU transfers under safeguards)
• Provider privacy policy

ipify

• Entity: ipify (ipify.org)
• Purpose: Detection of the device public IP address at consent and login time, to retain proof of consent.
• Data processed: Device public IP address.
• Location: United States (with data-transfer safeguards)
• Provider privacy policy

Amazon Web Services (AWS)

• Entity: Amazon Web Services EMEA SARL
• Purpose: Hosting of the station communication gateway (MQTT broker, telemetry database and operational logs).
• Data processed: Station telemetry and status, device identifiers, technical logs.
• Location: EU (Frankfurt, Germany)
• Provider privacy policy

Apple (Accedi con Apple, APNs, Apple Pay)

• Entity: Apple Distribution International Ltd.
• Purpose: Sign in with Apple (authentication), iOS push notifications (APNs) and payments via Apple Pay (processed by Stripe).
• Data processed: Apple account identifier / relay email, device push token.
• Location: EU (Ireland)
• Provider privacy policy

Payments

Stripe

• Entity: Stripe Payments Europe, Limited
• Purpose: Processing of payments and refunds, management of payment methods (incl. Apple Pay / Google Pay) and payouts to businesses (Stripe Connect).
• Data processed: Payment and card data, transaction amounts and history, billing data, email.
• Location: EU (Ireland)
• Provider privacy policy

Communications

Vonage (SMS)

• Entity: Vonage B.V.
• Purpose: Sending SMS to users (service notifications and station-related communications).
• Data processed: Phone number, SMS message content.
• Location: EU / United States (with data-transfer safeguards)
• Provider privacy policy

Resend

• Entity: Resend, Inc.
• Purpose: Delivery of transactional emails (receipts, rental notifications, service communications).
• Data processed: Email address, name, message content.
• Location: United States (with data-transfer safeguards)
• Provider privacy policy

WhatsApp Cloud API

• Entity: Meta Platforms Ireland Limited
• Purpose: Delivery of one-time login verification codes (OTP) via WhatsApp.
• Data processed: Phone number, verification code.
• Location: EU (Ireland) — Meta
• Provider privacy policy

Telegram

• Entity: Telegram FZ-LLC
• Purpose: Delivery of one-time login verification codes (OTP) via Telegram.
• Data processed: Telegram identifier/number, verification code.
• Location: United Arab Emirates (with data-transfer safeguards)
• Provider privacy policy

Anthropic (Claude)

• Entity: Anthropic PBC
• Purpose: AI assistant for customer support on WhatsApp: processes the content of support messages to generate replies.
• Data processed: Support message content (and any data the user provides in the conversation).
• Location: United States (with data-transfer safeguards)
• Provider privacy policy

Product analytics

PostHog

• Entity: PostHog, Inc. (EU Cloud)
• Purpose: Product and usage analytics to improve the Amperry app and services. Hosted on the EU cloud (eu.i.posthog.com).
• Data processed: Usage events, pseudonymous identifiers, device and session information.
• Location: EU (European cloud)
• Provider privacy policy

Station connectivity

1NCE (connettività IoT / SIM)

• Entity: 1NCE GmbH
• Purpose: Cellular connectivity for the stations via IoT SIMs (dedicated network and APN).
• Data processed: SIM identifier (ICCID), IMEI, station connectivity data.
• Location: EU (Cologne, Germany)
• Provider privacy policy

Stellar (gestione SIM M2M)

• Entity: A1 Digital International GmbH (Telekom Austria Group)
• Purpose: M2M SIM-management platform and monitoring of per-SIM data usage and cost for the stations.
• Data processed: SIM identifier (ICCID), data usage, connectivity cost.
• Location: EU (Austria)
• Provider privacy policy

Monitoring & diagnostics

Firebase Crashlytics

• Entity: Google Ireland Limited
• Purpose: Detection and diagnostics of app crashes.
• Data processed: Crash reports, device state, diagnostic technical identifiers.
• Location: EU / EEA (with possible extra-EU transfers under safeguards)
• Provider privacy policy

Sentry

• Entity: Functional Software, Inc. (Sentry)
• Purpose: Error and exception monitoring for the station gateway.
• Data processed: Error diagnostic data, technical identifiers.
• Location: United States (with data-transfer safeguards)
• Provider privacy policy

---

This list may be updated when we add, replace or remove a provider. For questions about data processing, contact privacy@amperry.com.