Sub-processors
A sub-processor is a company we use that handles personal data while we provide BagEvent. This page lists them, what each one does for us, and which personal data it handles. The same list appears in our privacy policy.
For attendee data collected through an event, the event organizer is the controller and BagEvent is the processor, so these companies are sub-processors of the organizer's data. For organizer account data, BagEvent is the controller.
Running the platform
| Service | What it does for us | Personal data it handles |
|---|---|---|
| Google Cloud Platform (Google) | Hosting and infrastructure: servers, databases and file storage, in Singapore (asia-southeast1). | All platform data — organizer accounts, events, registrations, orders and check-ins. |
| Cloudflare | CDN, DNS and TLS termination for bagevent.io and its subdomains. | The IP address and content of every request that passes through it. |
| Mailgun | Sending email: confirmations, e-tickets, reminders, account emails and organizers' campaigns. | Recipient email addresses and the content of each email. |
| Stripe | Card payments for BagEvent subscriptions. Ticket payments run on the organizer's own Stripe account, under the organizer's agreement with Stripe. | Billing contact and payment details for subscriptions; for ticket sales, the buyer's email address and the order amount. |
| Twilio | Sending SMS messages, only where SMS is switched on. | Phone numbers and the text of each message. |
| xAI | The language model behind the AI assistant features. | What you ask the assistant, and the event data it reads to answer, within your own permissions. |
| HubSpot | Support chat in the organizer console, loaded only when you open it, and chat and enquiry forms on this website. | Name, email address and the content of chats and enquiries. |
| Firebase Cloud Messaging (Google) | Delivering notifications to the mobile app; on iOS it hands off to Apple Push Notification service for the final step. | The device's push token and the content of each notification. |
| Sign in with Google (Google) | Signing in with a Google account, only if you choose it. | Name, email address and Google account identifier. |
Ticket payments are a special case. Attendees pay through Stripe Checkout on the organizer's own Stripe account, so for ticket sales Stripe acts under the organizer's own agreement with Stripe, and the money never passes through BagEvent.
Embedded on event sites
Some content on an event site comes straight from another company: the visitor's browser loads it from that company, so it sees the visitor's IP address. No registration data passes through it.
| Service | What it does for us | Personal data it handles |
|---|---|---|
| Google Maps (Google) | The venue map on an event site, where the organizer shows one. The map is an embedded Google Maps frame that the visitor's browser loads directly from Google. | The venue address, and the visitor's IP address and browser details. No registration data is sent. |
| YouTube (Google) and Vimeo | Playing a video on an event site, only where the organizer has added a YouTube or Vimeo video. The player is an embedded frame that the visitor's browser loads directly from that service. | The visitor's IP address and browser details, and which video is played. No registration data is sent. |
This website, and when you contact us
These are used only on bagevent.io itself or when you choose to reach us through them. They do not run on event sites.
| Service | What it does for us | Personal data it handles |
|---|---|---|
| Plausible | Cookieless usage analytics on this marketing website only, not on event sites. | Page views, without cookies or a personal identifier. |
| Google Analytics (Google) | Usage analytics on this marketing website only, loaded only if you consent, never on event sites. | Pages visited and a cookie identifier. |
| WhatsApp (Meta) | Messages you choose to send us on WhatsApp, under WhatsApp's own terms. | Your phone number, profile name and the messages you send. |
Where the data goes
The platform is hosted on Google Cloud Platform in Singapore. Several of the services above are run from outside Singapore, including from the United States. Where they receive personal data, we require a standard of protection comparable to Singapore's Personal Data Protection Act. The privacy policy explains the basis for transfers from the EEA and the UK.
Not on this list
- Chatwoot is open-source support software that we run ourselves, at live.bagevent.io. It is not a separate company. It holds enquiries sent before this website's chat and forms moved to HubSpot.
- PayPal and other payment providers are not available on BagEvent today. Stripe is the only payment provider.
- An organizer's own analytics. An organizer can add their own Google Analytics 4, Meta Pixel, LinkedIn Insight Tag, or Baidu Analytics identifier to their event site. Those run under the organizer's own account with that company, by the organizer's choice, and by default they load only after the visitor accepts.
Questions
For the Data Processing Agreement, see our DPA page. For anything else about this list, email milo@bagevent.io.
Last updated: 1 October 2026