Service Providers, Data Locations & Retention

Last updated: 5 October 2026. This page is referenced by our privacy policies and is kept current as our infrastructure evolves. It supplements the policies; the policies' commitments govern.

Kunobi Websites (kunobi.com / ninja.kunobi.com / profile.kunobi.com)

• Hosting and server logs — Cloudflare, Inc. (Workers, global network). Logs follow the configured retention settings.
• Content delivery, video streaming, download delivery, anti-bot verification — Cloudflare, Inc. (global network). Cloudflare processes request metadata to deliver and secure content; we do not use it to identify users.
• Identity and sign-in — Clerk Inc., United States. Account data retained while your account exists.
• Payment processing (checkout and billing portal, on Stripe-hosted pages) — Stripe, Inc., United States.
• Measurement and marketing (only per your consent) — Google LLC / Google Ireland Limited, via Google Tag Manager.
• Newsletter and transactional email delivery — Resend, Inc., United States. Newsletter contacts retained until you unsubscribe.
• Operational monitoring (server-side traces) — SigNoz Inc. Retained only as long as needed for operations.

Kunobi Desktop

• Identity and sign-in (optional accounts) — Clerk Inc., United States. Account data retained while your account exists.
• Backend hosting (account features, notifications) — Google Cloud Platform (Google LLC), United States and other Google locations.
• Diagnostics storage and analysis (opt-in telemetry, crash counters, consented crash reports) — operated by Zondax on Google Cloud Platform infrastructure. Diagnostics are retained only as long as needed for analysis and then deleted or aggregated.
• Update and download delivery — Cloudflare, Inc. (global network). Cloudflare processes request metadata to deliver and secure updates and downloads; we do not use it to identify users.

Zondax Ping

• Sign-in, push delivery, app attestation — Google LLC (Firebase Authentication, Firebase Cloud Messaging, Firebase App Check), United States and other Google locations.
• Push delivery and attestation on iOS — Apple Inc. (APNs, App Attest/DeviceCheck), United States and other Apple locations.
• Backend hosting and storage — Google Cloud Platform (Google LLC). Push tokens and device registrations are retained while the device is registered and removed on account deletion.
• Incident data — retained as long as needed to provide the service or per your team's configuration.

Transfers

Where these providers process personal data outside Switzerland or the EEA (notably in the United States), we rely on recognized standard contractual clauses or an applicable adequacy decision. Contact dataprotection@zondax.ch for information about the safeguard applying to a specific transfer.