Last updated: September 14, 2026
This page lists the companies that process BaoJai user data on our behalf, where they do it, and how long data is kept. It supports section 3 and 4 of our Privacy Policy. Every provider works under a data-processing agreement and may use your data only to provide its service to us. We do not sell personal data.
| Purpose | Provider | Location | Data involved |
|---|---|---|---|
| Application hosting | Google Cloud Run (Google LLC) | Indonesia (Jakarta, asia-southeast2) | Everything the App sends to our servers, while being processed |
| Database, sign-in and file storage | Supabase, Inc. | Japan (Tokyo, ap-northeast-1) | Account, content, wellness data, reports, recordings |
| Delivery of images, audio and video | Cloudflare, Inc. | Global edge network | The media file requested and your IP address, for the delivery only |
| Crash and error reporting | Functional Software, Inc. (Sentry) | United States | Device model, OS, app version, stack trace; your analytics identifier if you opted in to usage analytics |
| Usage analytics and screen recordings (opt-in) | PostHog, Inc. | European Union (Frankfurt) | Screen and feature events, masked screen recordings, app version, device type, account ID |
| Push notification delivery | Expo (650 Industries, Inc.) | United States | Your device push token and the notification text |
| AI insights, assistant and report summaries | Google LLC (Gemini API) | United States | A summary of your session or daily wellness metrics, only when you ask for an insight or a report |
| AI music generation | Suno (via the SunoAPI.org gateway) | United States | The prompt text, title and style you enter |
| Place search for location tags | Google LLC (Places API) | United States | Your approximate position and the text you type, only while the place picker is open |
| Sign in with Apple / Google | Apple Inc. · Google LLC | United States | Handled by them; we receive the name and email you approve |
| Data | Kept for |
|---|---|
| Account, content, wellness data, health reports | While your account is active; erased within 30 days of deletion |
| Contributed raw ring sensor data (opt-in) | Up to 12 months, or immediately when switched off |
| Usage analytics — screen recordings (opt-in) | 30 days |
| Usage analytics — events (opt-in) | 12 months |
| Crash and error reports | 90 days |
| Access and security logs | 90 days |
| Deleted account (grace period) | 30 days, then permanently erased |
Live video classes run on servers we operate ourselves; no third party receives that video. Questions: info@scai.co.th.
