Sub-processors
Every outside company that touches HeyBlu data, what each one actually receives, and where it sits. Our Privacy Policy is at heyblu.co/privacy.
Your call is not recorded, so no company on this page — not one — ever receives audio of you. There is nothing to hand over.
Nobody on this page may use your data for their own purposes, and nobody may train an AI model on it. No advertising network appears on this list, because none of them receives anything from a call.
"If a company isn't on this page, it doesn't have your data."
To run HeyBlu we use other companies for things like hosting, connecting your call, and taking payment. In law those companies are our processors — they hold or handle data on our instructions only, under a written contract, and never for their own ends. This page names them so you can see the whole list, and see it change.
Section 1Who we use, and what each receives
This is the complete list of companies that can hold or handle data about you as part of running HeyBlu.
| Who | What they do for us | What they receive |
|---|---|---|
| DigitalOceanSingapore | Our production servers, database, application logs and backups | Your account details, your Emotional Receipts, your conversation summaries while continuity is on, billing contact fields, and the working text of a call where it is saved. Operational logs can contain fragments of the same. |
| Amazon Web Services (S3)Singapore | File storage | Files uploaded in the app, and the speech-to-text output produced from a call. |
| AgoraUnited States | Carries the call itself, and turns speech into the working text | The call as it happens. HeyBlu does not use a telephone network — your call runs over Agora instead. No recording is kept. |
| OpenAIUnited States | Writes your Emotional Receipt from the working text | The working text of a call, and the summary written from it. Contractually barred from training on it. See section 5 for how long it can sit in their own abuse-monitoring logs. |
| StripeUnited States | Payments and subscriptions | Your payment method, the amount, and billing contact details. Never anything about what you talked about. HeyBlu does not hold your full card number. |
| PostmarkUnited States | Account email: sign-in codes, password messages, account notices | Your email address and the contents of that message. |
| MailchimpUnited States | Marketing email, and enquiries sent through our website | Your email address, your name where you gave it, and whether you opened or clicked. Nothing from a call. |
| Firebase Cloud MessagingGoogle · global | Delivers push notifications to your phone | Your device's push token and the routing information needed to reach it. We do not put anything personal about you in the notification itself. |
| VercelGlobal edge | Hosts the public heyblu.co website | Ordinary web request information for the website only. The website is separate from the app and from calls. |
| Ionic AppflowUnited States | Builds the mobile app | Our own source code and build files. It is not a home for your data — we list it for completeness. |
Section 2The website, separately
Our public website uses ordinary web analytics so we can tell whether the site works. These services see website visits — they never see your calls, your receipts, your summaries, or anything you say to a Blu Bud, because the website and the app are separate systems.
| Who | What they do | What they receive |
|---|---|---|
| Google Analyticswith Google Tag Manager | Counts website visits | Browser, device and page-visit information from heyblu.co. |
| Microsoft ClarityUnited States | Shows how the website is used, so we can fix what confuses people | Website interaction information from heyblu.co. |
No advertising network operates on heyblu.co. The analytics services named above see the website only — nothing from a call, a receipt or a summary ever reaches them, because the website and the app are separate systems.
Section 3Who is not on this list
A sub-processor list is only meaningful if you can also see what is missing from it on purpose.
- No advertising network. Nothing from a call, a receipt, a summary, or an app screen goes to any advertising platform. We do not sell your personal information and we do not share it for advertising.
- No data broker. We do not buy information about you, and we do not sell or trade what we hold.
- No telephone carrier. Your call does not travel over a phone network, so no carrier holds a record of it.
- No AI training, by anyone. Not us, not OpenAI, not any company on this page.
- No affiliate. No other company in our group receives your data.
- No employer. If your employer pays for HeyBlu, they buy access, never visibility. They are not a recipient of anything, and this is a condition of every enterprise contract.
Section 4What we hold every one of them to
Every company on this page is engaged under a written data processing agreement. Those agreements require them to:
- Our instructions only
- They may use your data to do the job we hired them for, and for nothing else of their own.
- No training
- They may not use your data to train or improve AI models.
- Security
- They must protect it, and tell us promptly if anything goes wrong so we can act on our own notification clocks.
- Deletion
- They delete it when we tell them to, or when our contract ends.
- Their own suppliers
- They may not hand it to anyone else without being bound by the same terms.
- Transfers
- Where data leaves your region, the transfer runs on legally recognised safeguards — standard contractual clauses or the UK addendum.
Section 5Two things we want to be exact about
OpenAI does not train on what we send. But like most providers, it keeps what passes through its API in its own abuse-monitoring logs for up to 30 days before deleting it. That is theirs, not ours, and we cannot shorten it by asking. We are telling you because "they don't keep it" would be the easier sentence and it would not be true.
When you ask us to delete something, we remove it from our live systems and instruct every processor holding it to do the same. Deletion reaches our backups and archives as well. We do that by hand rather than automatically, which is why we complete it within 30 days rather than instantly. Section 9 of the Privacy Policy sets out what we must keep by law.
Section 6How you find out when this changes
This page is the list. When it changes, it changes here first.
- Adding or removing a company: we update the page and date the change in the log below, so you can see the shape of it over time rather than just today's snapshot.
- A material change — a new kind of data going somewhere new — is announced in the app and by message at least 30 days before it starts, so you can look at it and decide.
| Date | Version | What changed |
|---|---|---|
| 7 October 2026 | 1.0 | First published. |
Section 7Contact
- Company
- Unbroken Consulting Pte. Ltd. · UEN 202511691N
68 Circular Road, #02-01, Singapore 049422 - Privacy
- privacy@heyblu.co
- Data protection officer
- Jet Domingo · jet@mindnation.com
- General
- hello@heyblu.co
- Privacy Policy
- heyblu.co/privacy
- Terms of Service
- heyblu.co/terms
- Health privacy
- heyblu.co/health-privacy
- In an emergency
- 911 · 988 Suicide & Crisis Lifeline
If you want to know more about any company on this page — what it holds, or why we use it — write to privacy@heyblu.co and a person will answer you.