Legal
Subprocessors
Last updated: September 21, 2026
This is the current list of subprocessors used by Broctic Inc. It forms part of our Privacy Policy.
Subprocessors
These providers process personal data on Broctic’s behalf to deliver the service. Each receives only the data it needs for the purpose listed.
| Name | Purpose | Location |
|---|---|---|
| Amazon Web Services | Application hosting (API on App Runner, website on Amplify), container images and storage | United States (us-east-1, N. Virginia) |
| Hetzner | Server hosting for our Postgres database | United States (Ashburn, Virginia) |
| Cloudflare | DNS | Global network |
| Expo (EAS and Snack) | Native iOS and Android builds; in-browser app preview | United States |
| GitHub | Actions runners that build and test apps; optional sign-in | United States |
| Upload-Post | Publishing marketing posts to connected Instagram and TikTok accounts | See provider |
| Resend | Transactional email such as password resets and invitations | United States |
| Optional sign-in | United States | |
| OpenRouter | AI models that write app code and suggestions in the Studio | United States |
Services you connect
These services are used only when you connect them with your own account or API key. They process data under your agreement with them; Broctic sends them data on your instructions.
| Name | Purpose | Location |
|---|---|---|
| Apple (App Store Connect and App Store Server) | App submission, store listings, sales and analytics reports, and the in-app purchase and subscription events Apple reports for your app | United States |
| PostHog | Product analytics and session replay for your app | US or EU, as you choose |
| OpenRouter | Artwork you generate with your own OpenRouter key | United States |
| Instagram and TikTok | Destinations for marketing posts you publish | Per platform |
Changes
We update this page before a new subprocessor starts processing personal data. To ask about a subprocessor or to object to a change, email irennie@broctic.com.