Sub-processors
BailaYa — operated by Infinity Curve LLC · Last updated 2026-09-07
This page lists the third parties that process personal data on BailaYa's behalf. It supports the Privacy Policy, which explains what we collect and what rights you have.
If you run a studio on BailaYa, you are the controller of your students' data and we are your processor. Most of the companies below are therefore our sub-processors, and this page exists so that you can see who they are before you agree to them (GDPR Art. 28). Some are not — where a company acts on its own account rather than on our instructions, or is your provider rather than ours, we say so rather than blurring it.
1. Always involved
These process personal data for every studio.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Contabo GmbH | Runs the application and the database | All platform data | European Union |
| Bunny.net (BunnyWay d.o.o.) | Content delivery and protection | Everything in transit. Bunny decrypts each request to serve it, so all traffic passes through it — not only your IP address and browser. It does not store your studio's records | Global edge network — not confined to the EU. The company is in Slovenia (EU) |
| Sentry | Error monitoring and session replay | Error context; recordings of a sample of sessions | European Union |
| Google (Maps Platform) | Address autocomplete on the sign-up form and when a studio adds a location | The address as it is typed, character by character | United States |
| Scaleway SAS | Sending transactional email; storing uploaded images; off-site encrypted backups | Name, email address, message contents. Images your studio uploads. A nightly copy of the database, encrypted before it leaves our servers, and a copy of uploaded files | France and the Netherlands |
| Resend | Sending marketing email | Name, email address, message contents | United States |
| Stripe | Card payments — studio subscriptions and student payments | Email, amount, payment details (card data goes to Stripe directly and is never stored by us) | United States |
| Likotech Software | Sells and bills your BailaYa subscription and the platform fees on student payments (our affiliate) | Studio contact and billing details | United States |
2. Only if your studio enables them
Nothing is shared with these until you switch them on.
| Company | Purpose | Data |
|---|---|---|
| Meta (WhatsApp Business) | WhatsApp notifications | Phone number and message content |
| Telegram | Telegram notifications, for students who connect their account | Telegram account id and message content. We never see the student's phone number |
Your own providers
These are different, and the difference is worth a moment. When you connect a payment gateway or a meeting tool, you use your own account — your merchant account, your Zoom login. You contract with that company directly; we simply hold your credentials and talk to it on your behalf. They are your providers, not ours, and your agreement is with them.
We list them because you should know we transmit data to them. Note that when you publish to Meetup, or create meetings through Zoom or Microsoft, those companies act as independent controllers under their own terms rather than on anyone's instructions.
| Company | Purpose | Data |
|---|---|---|
| MercadoPago, PayFast, Bank of Georgia, TBC Bank, WebMoney | Payments through your own merchant account | Student name, email, amount |
| Zoom, Google Meet, Microsoft Teams | Virtual classes and join links | Enrolled students' names and email addresses |
| Eventbrite, Meetup, Facebook Events | Publishing your classes to event platforms | Class details and studio contact data |
3. Marketing, and only with consent
These run on our public marketing site only, and only after a visitor accepts the relevant cookies. They are not part of the studio application and they do not touch your students' data.
Strictly, these are not our sub-processors: under their own terms each one decides its own purposes, so they act as independent controllers — and for the Meta Pixel, as a joint controller with us. We list them anyway, because what matters to you is who receives data, not which article of the GDPR governs it.
| Company | Purpose | Consent needed |
|---|---|---|
| Google (Firebase / Google Analytics) | Understanding how our site is used. Firebase Analytics is Google Analytics under a different name — the same data, reported through our Firebase project | Analytics |
| Google Ads | Measuring our advertising | Advertising |
| Meta Pixel | Measuring our advertising | Advertising |
| HubSpot | Booking a demo — a link to their site, not an embed | None; only if you follow the link |
Session replay
Sentry records a sample of sessions so that we can see what actually happened when something breaks. Text, form inputs and images are masked before the recording leaves your browser — a replay shows us the shape of what you did, not your students' details. Recordings are processed in the EU.
If you would rather we did not record your sessions at all, contact us and we will exclude your studio.
Where files and backups live
Images your studio uploads are stored with Scaleway in France. They used to sit on our own servers; moving them to a managed store means one fewer thing for us to lose and no change to who can read them — they are public images, served from our own domain either way.
Once a night a copy of everything goes off-site to Scaleway in the Netherlands, a different region from the live data, so losing one does not lose both. The database copy is encrypted by us before it is sent, to a key that never leaves our own keystore — Scaleway stores that file without the key and cannot read it. Our blog runs on our own servers, and our currency-rate provider receives no personal data.
When this list changes
If you run a studio, we email you before a new sub-processor starts handling your data — at least 30 days before it takes effect. You do not need to subscribe to anything; the notice goes to every studio automatically, at the address we bill.
That gap is there so you can do something about it. If you object to a change, reply to the notice before the effective date and we will talk through the options with you. We also announce changes here, with the date each one takes effect.