Subprocessors. Every Company Involved. Bufin

Last updated 2026-08-18

A "subprocessor" is a company we rely on to run Bufin that may process a limited amount of personal data on our behalf. In the spirit of being transparent, here is the complete, current list. We keep it deliberately short: the fewer companies touch your data, the better.

1. Current subprocessors

• Cloudflare, Inc. (USA): hosting, our API, the shared database (D1), key-value cache, and abuse/DDoS protection (Turnstile). Processes: account identifiers, shared community data, short-lived IP addresses for security, operational logs.

• Google LLC (USA), Google Analytics 4, for visitors who consent to it. Processes: a randomly generated visitor identifier stored in a cookie, pages viewed, approximate location derived from IP, browser and device type. Advertising features are disabled in our configuration, so it is not used to build an advertising profile. It runs for nobody who declines the banner or whose browser sends Global Privacy Control or Do Not Track, and none of your financial data is ever sent to it.

• Microsoft (USA/EU), OneDrive sign-in and, for OneDrive users, storage of your data in an app folder of your own OneDrive. Processes: your Microsoft account identifier, email and name; your financial data stays in your OneDrive, not on our servers.

• No payment processor. Bufin is free, so nothing is sold and no payment data is processed on our behalf at all. The former payment provider (Lemon Squeezy) no longer receives anything and is no longer connected to the app.

• Google LLC (USA), Google sign-in and, for Google users, storage of your data in a hidden folder of your own Google Drive. Processes: your Google account identifier, email, name, and avatar; your financial data stays in your Drive, not on our servers.

A note on Google: for Drive users it acts as your personal storage rather than as our subprocessor, your financial files live in your cloud, and we keep no copy. We list it here anyway so this page is complete.

A note on the donation platform (currently Buy Me a Coffee): it is NOT a subprocessor of ours, because we send it nothing. If you choose to donate, you leave Bufin, and everything about that payment: your name, your email, your card, is collected by that platform under its own privacy policy and terms. We receive no webhook from it, store no record of who donated, and cannot connect a donation to a Bufin account even if we wanted to. That is also why a donation cannot unlock anything: we do not know it happened.

2. Market data for the Investments tab

The Investments tab shows live-ish prices, and those prices have to come from somewhere. We use free, publicly available market-data endpoints: currently Yahoo Finance, with a licensed provider (Finnhub) configured as a standby in case Yahoo breaks. Neither is listed as a subprocessor above, and here is exactly why.

Your browser never contacts them. Every request goes through our own Cloudflare endpoint, which asks the provider about a ticker symbol and passes the answer back. The provider therefore sees a request from our server for, say, "VDY.TO"it does not see your IP address, your browser, your account, your holdings, how many shares you own, or that any particular person is interested. Symbols are batched across all users and cached at the edge, so a popular ticker is usually one upstream request serving thousands of people.

In short: what leaves our servers is a list of ticker symbols, never a person. No personal data is transferred, which is why these are described here rather than in the list above. Your portfolio itself: what you hold, how much, what you paid, stays in your own storage, exactly like the rest of your financial data.

Reading a screenshot or a receipt with OCR happens entirely inside your browser, using an engine we host ourselves. No image is ever uploaded, to us or to anyone else.

3. International transfers

These providers operate global infrastructure, so data may be processed outside your country. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses, under each provider's own data-protection terms.

4. Changes to this list

We'll keep this page up to date. If we add or replace a subprocessor that handles personal data in a material way, we'll update this list and, for significant changes, show a notice in the app before it takes effect: so you have a chance to object or, if you prefer, close your account.

5. Contact

Questions about our subprocessors: [email protected]. See also our Privacy Policy and Data Processing Addendum.