Our
subprocessors

About this list

Martia Labs sp. z o.o. is the controller of your personal data. To run Martia we rely on the providers below, and each one receives only the data its job requires.

This page is part of our Privacy Policy, which explains what data we process, why, and on what legal basis. We keep the list of providers here so that it is always current.

Processors handle data only on our instructions. Independent controllers decide for themselves how they process data, under their own privacy policies, so they are listed separately.

Providers that process data on our behalf

Google Cloud

• Purpose: Hosting the app and API, the PostgreSQL database (Cloud SQL), file storage, encryption keys, and logs.
• Data: Everything stored in your account: account details, bank data, chat history, imports, notes, and technical logs.
• Location: European Union

Auth0 (Okta)

• Purpose: Sign-in and account identity.
• Data: Email address, first name (if you provide it), account identifier, and sign-in details such as IP address and device.
• Location: European Union

OpenRouter

• Purpose: Routes requests to the AI models behind chat, transaction categorisation, imports, and insights.
• Data: Chat messages (including images), the financial context needed to answer, and transaction details sent for categorisation.
• Location: United States

Z.ai

• Purpose: Runs GLM models for some chat conversations and insight drafts.
• Data: Chat messages (including images), the financial context needed to answer, and spending summaries for insights.
• Location: China and Singapore

DeepInfra

• Purpose: Hosts the AI model that categorises your transactions and is a preferred host for Muse Lite chat requests routed through OpenRouter. For transaction categorisation, OpenRouter may use another host of the same model; we allow only hosts that do not retain that categorisation data.
• Data: For categorisation: transaction details (description, amount, date, counterparty name and account number) and your notes on them. For Muse Lite: chat messages (including images) and the financial context needed to answer.
• Location: United States

Together AI

• Purpose: Hosts Muse Lite for chat requests routed through OpenRouter.
• Data: Chat messages (including images) and the financial context needed to answer.

Google (Gemini)

• Purpose: AI models for categorisation when the main model is unavailable, reading imported files, search in the app, and spending analysis.
• Data: Transaction details, the contents of imported files, search queries, and spending summaries.
• Location: United States

xAI (Grok)

• Purpose: Backup AI model for categorisation and for reading imported files.
• Data: Transaction details and the contents of imported files.
• Location: United States

Anthropic (Claude)

• Purpose: AI models for some chat conversations and insight drafts.
• Data: Chat messages, the financial context needed to answer, and spending summaries for insights.
• Location: United States

DeepSeek

• Purpose: AI models for Standard chat, with requests routed through OpenRouter.
• Data: Chat messages and the financial context needed to answer them.

Alibaba (Qwen)

• Purpose: An AI model we try out for chat on a few accounts at a time instead of our usual one; yours is not one of them unless we have told you.
• Data: Chat messages and the financial context needed to answer them.

Meta

• Purpose: AI models for Muse Lite and Muse Wonder chat, with requests routed through OpenRouter.
• Data: Chat messages and the financial context needed to answer them.

TypeSafe (Jev)

• Purpose: Decides which insight, if any, is worth sending you. Selects the parser for XTB email attachments.
• Data: For insights: the names of counterparties whose payments changed — shops, companies and sometimes people you pay or who pay you, never members of your household — their category, and coarse signals about the change, grouped into ranges — no amounts, dates, or transaction descriptions. For attachment routing: normalized MIME types and file extensions only, without file names, contents or personal identifiers.
• Location: Outside the EEA

OpenAI

• Purpose: Transcribes the voice messages you record in chat.
• Data: Voice recordings.
• Location: United States

Stripe

• Purpose: Payments on the web, subscriptions, and invoices.
• Data: Email address, billing address, tax identification number (if you provide it), and payment details.
• Location: European Union (Ireland) and United States

RevenueCat

• Purpose: Manages subscriptions bought in the iOS app through the App Store.
• Data: Account identifier, App Store purchase and subscription details, and basic device information.
• Location: United States

OneSignal

• Purpose: Delivers push notifications to your phone and browser.
• Data: Your device's push token, a random identifier that is not your account identifier, the text of the notifications we send you, and basic device information.
• Location: United States

Resend

• Purpose: Sends our emails: account and support messages and insight emails.
• Data: Email address and the content of the email.
• Location: United States

Telegram

• Purpose: Delivers internal operational notifications to a private team chat.
• Data: Email address, name, and account identifier, with the event — for example a sign-up, a purchase, or an account-deletion request and the feedback left with it.
• Location: European Union (Netherlands)

PostHog

• Purpose: Product analytics in the app — only if you agree.
• Data: A pseudonymous account identifier and usage events. No chat content, transactions, or onboarding answers.
• Location: European Union (EU Cloud)

Google Analytics

• Purpose: Marketing-site analytics — only after you accept the cookie banner.
• Data: Approximate location, device type, pages visited, and traffic source. No account data.
• Location: Ireland (Google Ireland Limited), with a transfer to Google LLC in the United States

Serper

• Purpose: Looks up public information about merchants so we can name and categorise them.
• Data: Only the public merchant name from a transaction — never your identifier or amounts.

Synci

• Purpose: Bank connections for the banks indicated in the app (Poland and Belgium), paid for by Martia, using a separate managed user for each Martia account. Synci obtains financial data through GoCardless and processes it on Martia's instructions. Its Portal Privacy Notice describes its subprocessors and its separate, limited controller activities for platform security and administration.
• Data: Email address and an internal user reference; identifiers (including IBANs), balances and transactions from every account connected in Martia's Synci portal, including accounts added later; connection status.
• Location: Financial data stored in the European Union; subprocessor transfers described in the Synci Portal Privacy Notice.

Independent controllers

Enable Banking

• Purpose: A licensed account information service (AIS) provider that connects your bank in read-only mode.
• Data: Account list, balances, and transaction history, under the consent you give your bank.
• Location: European Union (Finland)

GoCardless

• Purpose: The bank-connectivity provider for connections through Synci to the banks indicated in the app (Poland and Belgium). It obtains bank data under the authorisation you give in its connection flow and provides it to Synci for delivery to Martia, under its own Bank Account Data End User Terms and privacy notice.
• Data: Account details, balances, transaction history and data needed to authorise and maintain the bank connection.

Apple

• Purpose: Takes payment for subscriptions bought in the iOS app (App Store).
• Data: Apple handles the payment details itself; we receive only the purchase status.

Services you connect yourself

If you connect Martia to an AI assistant such as ChatGPT or Claude, that assistant's provider processes what it reads from Martia under its own terms and at your request. It is not our subprocessor — you decide whether to connect it.

Transfers outside the EEA

Some providers process data outside the European Economic Area; the location of each one is shown above. For those transfers we rely on the mechanisms provided for by law: standard contractual clauses or an adequacy decision (including the EU–US Data Privacy Framework, where applicable).

Changes to this list

We update this page before a new provider starts processing personal data, and the date on this page changes with every update. Questions about our providers: support@martia.ai.