This appendix forms part of the Brain-Shot Academy privacy hub.
Privacy hub documents: Main Privacy Notice, Cookie Policy, Cookie Inventory, Processor Appendix, International Transfers Appendix, Retention Appendix, Legal Bases Matrix, and Required and Optional Data Matrix.
It provides a provider-specific summary of the principal processors currently relevant to the Brain-Shot Academy platform, the main countries or regions associated with those providers, and the transfer approach we use under applicable law.
Brain-Shot Academy-operated proprietary apps are primarily hosted in Switzerland.
1. Provider-specific overview
| Provider / service | Main country or region relevant to Brain-Shot Academy | Transfer position |
|---|---|---|
| Google LLC (Google Cloud) | Switzerland for Brain-Shot Academy-operated proprietary apps | Core proprietary-app hosting is in Switzerland. If Brain-Shot Academy uses another Google service that involves another country, we rely on the transfer mechanism required by applicable law, such as adequacy or another approved safeguard. |
| Supabase, Inc. | Switzerland for Brain-Shot Academy-operated proprietary apps | Core proprietary-app hosting is in Switzerland. If a Supabase function or delivery path involves another country, we rely on the transfer mechanism required by applicable law. |
| Amazon Web Services, Inc. (AWS) | Europe and, for some services, other countries depending on the AWS product used | AWS can be regional or more distributed depending on the service. Where AWS-related processing involves another country, we rely on the transfer mechanism required by applicable law, such as adequacy, standard contractual clauses, or another approved safeguard. |
| Hostpoint AG | Switzerland | Hostpoint is a Swiss-hosted provider used for communications services and relevant hosting or infrastructure services. Transfers outside Switzerland are not the expected baseline for this service. |
| BunnyWay d.o.o. (bunny.net) | Europe and global edge locations | Content delivery, caching, and edge protection can involve multiple countries because the service uses distributed edge infrastructure. Where required, we rely on the applicable transfer mechanism. |
| Mux, Inc. | United States and related provider locations | Media streaming, playback, and related delivery can involve U.S. processing. Where required, we rely on an adequacy decision, recognised certification framework, standard contractual clauses, or another lawful transfer mechanism. |
Intuition Machines, Inc. (hCaptcha) | United States and globally distributed delivery locations | Anti-abuse and challenge processing can involve U.S. and distributed infrastructure. Where required, we rely on an adequacy decision, recognised certification framework, standard contractual clauses, or another lawful transfer mechanism. |
FingerprintJS Inc. (Fingerprint) | Germany / EU for the current Brain-Shot Academy workspace region, with U.S. or other-country transfer safeguards relevant where another Fingerprint transfer path applies | Brain-Shot Academy currently uses Fingerprint's EU region for this service. Fingerprint's official region documentation states that data stays in the chosen region, which for the EU region is Frankfurt, Germany. Fingerprint's DPA and privacy materials also provide for standard contractual clauses, Swiss addendum treatment, and other transfer safeguards where relevant. |
| HubSpot Germany GmbH | Germany as the contracting entity; account hosting can be in Germany / the EU or another supported HubSpot region depending on account configuration | Brain-Shot Academy contracts with HubSpot Germany GmbH. Where HubSpot-related processing involves another country, we rely on the transfer mechanism required by applicable law. |
| Zoom Communications, Inc. | United States and other regions depending on account configuration and data-center choices | Meeting, webinar, and related communication processing can involve the United States or other selected regions. Where required, we rely on contractual safeguards and other lawful transfer mechanisms. |
| EvolMind S.L. | Spain | EvolMind is the legacy campus provider for campus.brain-shot.ch and is an EU provider in Spain. Transfers outside adequate jurisdictions are not the expected baseline for this service. |
| Stripe Payments Europe, Limited (and, where regulated payment services apply, Stripe Technology Europe, Limited) | Europe for the main Swiss / European contracting setup, with other countries also possible depending on payment method, payer location, fraud prevention, support, or subprocessors | Payment-related processing can involve multiple countries depending on the payment flow. Where required, we rely on an adequacy decision, recognised certification framework, standard contractual clauses, or another lawful transfer mechanism. |
2. Our general transfer approach
Where personal data moves between Switzerland and the EU / EEA:
- the EU has recognised Switzerland as providing an adequate level of protection
- under Swiss law, personal data may be disclosed to countries with an adequate level of protection without additional contractual guarantees
Where a provider chain involves another country, Brain-Shot Academy uses the transfer mechanism required by the applicable law. Depending on the case, this may include:
- an adequacy decision
- a recognised certification framework where applicable
- standard contractual clauses
- supplementary contractual, technical, and organisational measures
- another lawful transfer mechanism or exception
3. Contact
If you would like more information about international transfers relevant to your use of Brain-Shot Academy, please contact:
Brain-Shot Academy AG
Birsstrasse 320
4052 Basel
Switzerland
privacy@brain-shot.academy