Bytech LLP uses the third-party providers listed below to operate Deplion. Some of them process personal data on our behalf ("sub-processors"), and some act as independent controllers for their own part of the transaction.
This page supports Section 6 of the Privacy Policy.
1. Current sub-processors
| Provider | Role in the Service | Personal data processed | Processing location |
|---|---|---|---|
| Cloudflare, Inc. | Content delivery and network security for published sites | Published site content; visitor IP address and request metadata | Global |
| Polar Software, Inc. | Merchant of Record — checkout, payment processing, invoicing, sales tax and VAT | Name, email address, billing address, country, payment details, transaction history | United States, with onward transfer to other destinations outside the EEA and the United Kingdom |
| OpenAI, L.L.C. | Automated content moderation | Published site content, which may contain personal data placed there by the site owner | United States |
| Google LLC | Analytics for our marketing website and dashboard | IP address, device and browser information, pages viewed, referrer. Online identifiers only with consent | Global |
| PS.kz | Hosting infrastructure for the application | All application data described in the Privacy Policy | Kazakhstan |
Transactional email is operated by Bytech LLP on its own infrastructure in Kazakhstan. No external email delivery provider processes transactional or support email on our behalf.
Sign-in providers
These act as independent controllers, not as sub-processors. They do not process data on our instructions: you have your own relationship with each of them, governed by their own privacy notice. They are listed here because signing in through one of them means personal data flows between us.
Each provider is offered only if an operator has switched it on, and only if you choose it — an account can always be created with an email address and a password instead.
| Provider | What we receive |
|---|---|
| Google LLC | Account identifier, email address and whether the provider states it is verified, display name, profile picture URL |
| Microsoft Corporation | Account identifier, email address and whether the directory states it is verified, display name |
| GitHub, Inc. | Account identifier, primary verified email address, display name, avatar URL |
| Apple Inc. | Account identifier, email address (which may be Apple's private relay address) and whether Apple states it is verified, and your name — sent only the first time you consent |
In each case the provider learns that you hold an account with Deplion and when you signed in, and nothing further. We store no access or refresh tokens from any of them, and we never call their APIs on your behalf. You can remove a link at any time under Settings → Security.
2. Notes on specific providers
2.1. Polar acts as Merchant of Record. It is an independent controller for the payment data you provide to it, and it applies its own privacy notice to that data. We receive subscription status and order records, not your full card details. Polar is established in the United States; for personal data transferred out of the EEA or the United Kingdom it relies on the Standard Contractual Clauses adopted by the European Commission.
2.2. OpenAI receives published site content for automated moderation. It is not used by us to train models. Because you decide what to publish, you should avoid placing personal data in a published page that you would not want analysed by an automated moderation system.
2.3. Google analytics runs on our own marketing website and dashboard only, never on the sites our users publish. Until a visitor accepts the Analytics category in our cookie banner, no cookie is set and no identifier is read or sent; online identifiers reach Google only after consent. Cookies on published sites are the responsibility of the site owner. See the Cookie Policy.
2.4. Sign-in providers are reached only when you press their button. The redirect to the provider and back uses strictly necessary session cookies, which is why it is not gated behind the cookie banner. If you sign in with Apple and choose to hide your email address, we receive Apple's private relay address and use it exactly as we would any other; mail we send reaches you through Apple's relay.
3. International transfers
Several providers process personal data outside the European Economic Area and the United Kingdom. Where we transfer personal data from those regions, we rely on the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum. See Section 8 of the Privacy Policy.
4. Changes to this list
4.1. We will update this page before engaging a new sub-processor that processes personal data, or as soon as reasonably practicable afterwards where an urgent replacement is required.
4.2. To be notified of changes, write to [email protected] and ask to be added to the sub-processor notification list.
4.3. If you object to a new sub-processor on reasonable data protection grounds, contact [email protected]. If we cannot address the objection, you may terminate your subscription; Section 8.2 of the Refund Policy applies.
5. Contact
Bytech LLP (Limited Liability Partnership «Bytech») 29A microdistrict, building 90, office 202, Aktau, Mangystau region, 130000, Republic of Kazakhstan
- Privacy and sub-processor questions: [email protected]
Version 2026-08-10 — effective 2026-08-10.