Simmer — Sub-Processors List

_Last updated: July 3, 2026_

• Entity: Boiling Waters PH

This page lists the specific third-party sub-processors that Simmer uses to operate the platform. It is referenced by our Privacy Policy. This page may be updated independently of the Privacy Policy as vendors change.

Current Sub-Processors

• Amazon Web Services (AWS) — Category: cloud infrastructure. Purpose: compute, database, storage, content delivery. Data handled: all application data. Data residency: Singapore (ap-southeast-1).
• AWS Rekognition — Category: AI/ML services. Purpose: image moderation, identity verification (KYC). Data handled: uploaded images only. Data residency: Singapore (ap-southeast-1).
• Firebase / Google Analytics (GA4) — Category: mobile analytics & crash reporting. Purpose: app stability monitoring, anonymized usage analytics. Data handled: anonymized events, device tokens (no PII). Data residency: Global (Google Standard Contractual Clauses).
• PostHog — Category: product analytics. Purpose: feature flags, anonymized product metrics, session replay. Data handled: anonymized events (no PII). Data residency: EU region.
• HitPay — Category: payment processor (web). Purpose: credit/debit card and e-wallet payments. Data handled: tokenized payment information. Data residency: Philippines / Singapore.
• Maya (PayMaya) — Category: payment processor (web). Purpose: e-wallet payments (Philippines). Data handled: tokenized payment information. Data residency: Philippines.
• Apple — Category: mobile app store billing + push notifications. Purpose: iOS in-app purchases, subscription management, push delivery. Data handled: payment tokens, device tokens. Data residency: Global.
• Google — Category: mobile app store billing + push notifications. Purpose: Android in-app purchases, subscription management, push delivery. Data handled: payment tokens, device tokens. Data residency: Global.

Notes

• No PII is sent to analytics sub-processors (Firebase, PostHog). Only anonymized event data and device tokens are shared.
• Payment information is tokenized by the payment processor. Simmer never stores full card numbers.
• Identity verification images are processed by AWS Rekognition in the same region as our infrastructure (Singapore). Images are encrypted at rest and subject to time-limited retention (see Privacy Policy Section 7).
• All sub-processors operate under Data Processing Agreements (DPAs) and, where applicable, Standard Contractual Clauses (SCCs) for cross-border data transfers.

Change Log

• July 3, 2026 — Initial sub-processors list published.