In short
Transparent versioned list of the external providers MINOMO uses: hosting, email, push notifications, artificial intelligence, maps, payments, sign-in. Category, country and legal safeguard for transfers outside the EEA. Integral part of the Privacy Policy.
Here we transparently and versionably list every external provider to whom we entrust personal data processing in order to operate MINOMO. For each one we indicate the category, country, role, and the legal safeguard we apply when processing takes place outside the European Economic Area. This list forms an integral part of our Privacy Policy.
Our transparency commitments
Whenever we add, replace, or remove a provider we update this page, record the change in the change log at the bottom, and — if the change is material — notify you proactively by email and via an in-app notice.
By “material” we mean: a change of the country of processing, a change of service category, the addition of a new provider outside the EEA, replacement of the payments Merchant of Record, or replacement of the artificial intelligence provider that powers MINA.
The providers that process personal data on our behalf are bound by a written agreement that obliges them to:
- process personal data solely for the purposes we have entrusted to them;
- apply adequate technical and organisational security measures;
- notify us promptly in the event of a data breach;
- not use the data for their own purposes, except for aggregate operational statistics strictly necessary for delivering the service.
Transfer safeguards — legend
- EU / EEA — the provider is established in the European Economic Area and data remains within EEA jurisdiction. No additional safeguard required.
- UK — the provider is established in the United Kingdom. The transfer is covered by the European Commission adequacy decision of 28 June 2021.
- DPF + SCC — the provider is established in the United States of America. We apply Standard Contractual Clauses 2021/914/EU; where the provider participates in the EU-U.S. Data Privacy Framework, we additionally benefit from the adequacy decision of 10 July 2023.
List of providers
Infrastructure, hosting and CDN
| Provider | Category | Country | Transfer |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of application servers, databases (MariaDB) and Redis. This is the infrastructure on which MINOMO runs. | Germany (Nuremberg / Falkenstein) | EU / EEA |
| Amazon Web Services EMEA SARL | Amazon S3: storage of database backups. | Germany (Frankfurt); data in the EEA | EU / EEA |
| Cloudflare, Inc. | Content Delivery Network (CDN), DNS, Anti-DDoS, Web Application Firewall (WAF), Turnstile (anti-bot verification replacing reCAPTCHA) and R2 object storage for uploaded images (bucket minomo, served via cdn.minomo.io). For the public pages of municipalities published on the municipalities’ own domains, Cloudflare also issues the security certificate and routes the traffic (Cloudflare for SaaS and Workers), and it serves the Matomo statistics script on part of the site. | United States of America (with EEA edge presence) | DPF + SCC |
Email communications
| Provider | Category | Country | Transfer |
|---|---|---|---|
| vhosting solutions S.r.l. (vhosting cloud) | SMTP server for the transport of transactional emails (access OTPs, registration confirmations, receipts, system notifications). Endpoint: mx1.vhostingcloud.com. | Italy (Salerno) | EU / EEA |
Push notifications
| Provider | Category | Country | Transfer |
|---|---|---|---|
| Google LLC — Firebase Cloud Messaging (FCM) | Delivery gateway for push notifications to Android devices and, through the FCM relay, to iOS devices. Receives the device token and the title and text of the notification. | United States of America | DPF + SCC |
| Apple Inc. — Apple Push Notification service (APNs) | Final delivery of notifications to iOS devices, received from FCM. Receives the device token and the notification content. | United States of America (with European infrastructure) | DPF + SCC |
For the PWA (Web App) version of the service we do not use any third-party gateway: we manage the Web Push standard directly with VAPID keys signed by AVi Kairos Srl.
Artificial intelligence
| Provider | Category | Country | Transfer |
|---|---|---|---|
| Anthropic, PBC | Provider of generative AI models used for: MINA (questions, preferences and, if you choose to start from where you are, start coordinates); automatic checking of issue reports (text and category only, without data about the author); reading the event sources indicated by City Agents; enriching merchants’ descriptions from public sources on the web; suggesting text to merchants at onboarding. | United States of America | DPF + SCC |
InfoPilot (it.infopilot.ai) provides the AI chat assistant on minomo.io. Its script is loaded only when you click to open the chat, and it receives what you write in the chat. In the merchant panel the same assistant, where it is switched on, also receives the merchant’s identifier, email and business name. Its own privacy information applies to the chat.
Maps and geographic services
| Provider | Category | Country | Transfer |
|---|---|---|---|
| Google LLC — Geocoding API | Converts the addresses of merchants and places, entered in the panels, into coordinates. | United States of America | DPF + SCC |
| OpenStreetMap Foundation | Map images (tiles) in the app and on public pages, and the Nominatim service that finds the name of a locality from coordinates (events page). Receives the IP address and the map area or coordinates requested. | United Kingdom | UK |
Other services called by the app, which receive the IP address of the device and the data needed for the request:
- CARTO — map images (Voyager tiles) in the app: receives the map area being viewed, which may be centred on your position;
- OSRM (
router.project-osrm.org) — walking routes of MINA tours: receives the start coordinates and the stops; - Open-Meteo — weather on the home screen: receives the coordinates of the city, not yours;
- QR image service (
api.qrserver.com) — draws the QR code of a loyalty card: receives the value encoded in the code; - unpkg.com — map library (Leaflet), loaded by the app only when a map has to be shown (municipal pages and public merchant pages get it from MINOMO’s servers).
On municipal pages the map images come from OpenStreetMap, and are loaded only when there are reports to show.
Payments
| Provider | Category | Country | Transfer |
|---|---|---|---|
| Paddle.com Market Ltd | Payment processor acting as Merchant of Record for MINOMO wallet top-ups, and for the purchase of AI credits by City Agents. Handles EU VAT, invoicing and refunds directly. Payment credentials (card number, etc.) are processed exclusively by Paddle in accordance with PCI-DSS standards: MINOMO never sees or stores card data. | United Kingdom (London) | UK |
Social authentication (‘Sign in with…’)
These providers are involved only if the user chooses to sign in to MINOMO using an existing third-party identity. If you sign in via email OTP, none of these providers is involved.
| Provider | Category | Country | Transfer |
|---|---|---|---|
| Google LLC — Google Identity Services | ”Sign in with Google” on web, Android and iOS. The Google script is loaded only when you click on the button. We receive the user’s name, verified email address, Google ID and the address of the Google profile picture, which we save in the user’s profile. | United States of America | DPF + SCC |
| Apple Inc. — Sign in with Apple | ”Sign in with Apple”. We receive a unique identifier and, optionally, an email address (which may be a private alias provided by Apple). | United States of America (with European infrastructure) | DPF + SCC |
Native app builds
| Provider | Category | Country | Transfer |
|---|---|---|---|
| Nevercode Ltd — Codemagic | Continuous integration platform for compiling, signing and distributing MINOMO’s iOS and Android applications to the App Store and Google Play. Codemagic has access to the app source code, not to end-users’ personal data. | Estonia | EU / EEA |
What we don’t use
For explicit reference and clarity, the following third-party services — commonly found on comparable platforms — are not present on MINOMO:
- Google Analytics, Google Tag Manager;
- Meta Pixel, Facebook Conversions API;
- LinkedIn Insight Tag;
- TikTok Pixel;
- Hotjar, Mixpanel, FullStory, LogRocket or other session-replay tools;
- OneSignal, Pushwoosh or other commercial push notification providers (we manage these in-house);
- data brokers, advertising exchanges, or ad-tech of any kind;
- Stripe, PayPal or any payment processor other than Paddle.
Should we ever need to introduce any of these tools — or an equivalent — we will add it to this page in advance, explaining the rationale.
Contractual documents on request
Upon formal request you may obtain a copy of the Standard Contractual Clauses 2021/914/EU we apply to a given provider outside the EEA, the corresponding Transfer Impact Assessment (TIA), and a summary sheet of the provider’s technical and organisational measures. Requests should be directed to [email protected].
Merchants operating on the MINOMO platform who entrust us with personal data processing on their behalf may request a dedicated Data Processing Addendum (DPA). You will find it at /en/legal/dpa/.
Change log
| Version | Date | Change |
|---|---|---|
| 1.2 | 7 October 2026 | Added Amazon Web Services EMEA SARL (Amazon S3) for database backups; Google sign-in: profile picture address. Added Anthropic for the uses other than MINA, the AI chat assistant, Google Geocoding, OpenStreetMap and the other map and weather services called by the app, Cloudflare for municipal pages; Paddle also for City Agents’ AI credits. Removed the statement that Anthropic is contractually barred from training on prompts, which we cannot document here. |
| 1.1 | 11 June 2026 | Removed Facebook Login (Meta Platforms, Inc.): it is no longer a supported sign-in method on MINOMO. |
| 1.0 | 15 May 2026 | First publication: full list of MINOMO providers accompanying the new Privacy Policy v3.0. |
Contact
For questions, document requests or reports relating to this page: [email protected]