Legal

Effective May 10, 2026

Subprocessors

To run Out Budget we rely on a small number of third-party services. Each one is bound by a data processing agreement and may only use your data on our instructions. The list below is authoritative and is updated whenever a subprocessor is added, removed, or changed.

Current subprocessors

ServicePurposeData processedRegion
SupabaseDatabase, authentication, storage.All account and financial data you create in the app, plus auth credentials (password hash, session tokens).AWS eu-central-1 (Frankfurt)
VercelApplication hosting and edge delivery.Request metadata (IP, user agent, URL). No financial data is stored here.Global edge; primary region AWS eu-central-1
StripePayments (when paid plans launch).Email, billing address, masked card details, payment metadata. Out Budget never stores full card numbers.EU and US (per Stripe’s data processing terms)
ResendTransactional email (signup confirmation, password reset, billing receipts).Email address and the contents of the message.EU
PostHogAggregated product analytics (only with your consent).Anonymised page-view and event data; IP truncated. EU-hosted at eu.posthog.com.EU
SentryError monitoring and short Session Replay snippets on errors. The browser SDK only loads with your analytics consent; the server SDK runs for all requests under legitimate interest to keep the service reliable.Stack traces, page URL, browser/OS, timezone, locale. No IP address, cookies, or request headers (sendDefaultPii is disabled). When an error fires after consent, a masked DOM replay with text redacted and media blocked.EU (Frankfurt)

Notice of changes

We will publish any change to this list at least 30 days before it takes effect. If you are a DPA customer, you may object to a new subprocessor by replying to the change-notice email; if we cannot accommodate your objection, you may terminate without penalty for the unused portion of your subscription.

Related pages

Contact

Questions? Email support@outbudget.com.