Sub-processors
Sub-processors and service providers
Last updated 11 October 2026 · Version 2026-10-11
We use a small number of other companies to run Bazm. This page lists every one that handles personal data, what it does and where. It is referred to by our Privacy Policy and our Data Processing Addendum.
1. Sub-processors
These companies process organisers’ participants’ data on our behalf in order to provide the Service.
| Company | What it does for us | Personal data involved | Where |
|---|---|---|---|
| IONOS SE | Hosting: the servers that run the application and the database, and their logs | All data held in the Service | United Kingdom |
| Cloudflare, Inc. | Content delivery and security: web and app traffic to bazm.io passes through Cloudflare’s network (encryption in transit, caching, protection against denial-of-service attacks and automated abuse, and a limit on repeated requests). Turnstile checks that sign-in, sign-up and password-recovery requests come from a person. Web Analytics counts page loads. File storage: uploaded files, files Bazm generates, session recordings and database backups. | For delivery and security: the IP address, browser details and address requested of every visit, the content of requests and responses while they pass through (including what is typed into forms), and the signals and result of a Turnstile check. For Web Analytics: page-load timings, not individual visitors; it is not run for visitors in the European Union. For file storage: uploaded files and recordings, and files Bazm generates such as certificates, signed contracts, badge exports and account data exports. Backups are encrypted before they are uploaded. | Cloudflare’s network, which serves each visit from a data centre near the visitor. For file storage: European storage selected. The company is based in the United States. |
| Resend, Inc. | Sending email | Recipients’ email addresses and the content of the emails | United States |
| Stripe Payments UK Ltd and its group companies | Payments into organisers’ own Stripe accounts, invoices, and organisers’ payments to Bazm | The payer’s name, email address, country and tax number, and payment amounts. Card numbers and security codes are entered directly with Stripe. | United Kingdom, European Union and United States |
| LiveKit, Inc. | Live audio and video for virtual sessions, and recording when the organiser records a session | Display name, account identifier, IP address, and the audio and video of people who speak | United States, with media servers worldwide |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | Technical details of errors, which can include some of the data being handled when the error happened, and timings for a sample of requests. In the mobile app, the account identifier. | Germany |
| Google LLC (Firebase Cloud Messaging) | Delivering push notifications to the mobile app | The device’s push token, the text of the notification and the place in the app it opens | United States and worldwide |
| Google LLC (Gemini) | The language model behind the AI features. Used only when an organiser has AI features enabled. | The text described in section 6 of the Privacy Policy | United States and worldwide |
2. Companies involved only when a feature is used
| Company | What it does for us | Personal data involved | Where |
|---|---|---|---|
| Google LLC (Maps, Fonts, YouTube) | A venue map, a custom font or an embedded video on a conference website, when the organiser adds one. Fonts in the mobile app. | The visitor’s IP address and browser details, sent by the visitor’s own browser or device | United States and worldwide |
| OpenStreetMap Foundation | The venue map on a conference website when Google Maps is not used | The visitor’s IP address and browser details | United Kingdom and worldwide |
| LinkedIn Ireland Unlimited Company | An embedded LinkedIn post on a conference website, when the organiser adds one | The visitor’s IP address and browser details | Ireland and worldwide |
| Google LLC (Google Wallet) | Saving a badge to Google Wallet, when the organiser offers it and the attendee chooses to | The attendee’s name, the badge’s QR code, the conference and the ticket type | United States and worldwide |
An organiser can also show images that are hosted elsewhere on their conference website, for example a speaker’s photo or a picture in a custom section of a page. A visitor’s browser fetches those from whichever host the organiser chose, which sees the visitor’s IP address.
3. Providers we use to run our own business
For these, Bazm is the controller: they are not processing organisers’ participants’ data on an organiser’s behalf.
| Company | What it does for us | Personal data involved | Where |
|---|---|---|---|
| tawk.to, Inc. | Live chat on our support and enquiry pages | The conversation, the visitor’s IP address and browser details, and a signed-in user’s name, email address and account identifier | United States |
| IONOS SE | The mailboxes behind our @bazm.io email addresses | Emails sent to us, including messages from the contact form, and our replies | Germany and United Kingdom |
| Google LLC (Firebase Analytics and Crashlytics) | Usage statistics and crash reports from the mobile app | The names of screens opened, the account identifier, device and app details, and crash details | United States and worldwide |
| Calendly, LLC | Booking a demonstration with us | What you enter when you book: your name, email address and chosen time | United States |
| Atlassian (Trello) | Keeping track of the conference organisers we have written to about Bazm | The organiser’s name, role, organisation and work email address, and what we sent | United States and worldwide |
4. Changes to this list
We update this page before a new company starts handling personal data for us. Where it is a sub-processor, we also email the owners of each organisation at least 30 days beforehand, as the Data Processing Addendum requires. If you have a question about any company listed here, write to contact@bazm.io.