Subprocessors
- Version:
2.0.0- In force since:
- October 02, 2026
- Supersedes:
- 1.0.0 (August 29, 2026)
- Operated by:
- GMB TECNOLOGIA LTDA — CNPJ 68.727.144/0001-88
This page lists the third parties that process data on behalf of Upuai Cloud, operated by GMB TECNOLOGIA LTDA (CNPJ 68.727.144/0001-88). It forms part of the Privacy Policy and the Data Processing Addendum (DPA).
Language. This is a courtesy translation. The Portuguese version at upuai.com.br/subprocessadores is the binding version; in case of divergence, it prevails.
All subprocessors are subject to contractual confidentiality and data protection obligations comparable to those we owe you, and may process data only on our instructions.
1. Infrastructure
The production infrastructure that runs your applications, databases, buckets and volumes is our own, operated by us on dedicated servers in a datacenter located in Belo Horizonte/MG, Brazil. We do not use a third-party cloud provider to run Customer Content.
| Vendor | Purpose | Data involved | Country |
|---|---|---|---|
| Wave Up Telecom | Datacenter connectivity and IP transit | Network traffic in transit | Brazil |
2. Platform operation
| Subprocessor | Purpose | Data involved | Country |
|---|---|---|---|
| Cloudflare | Authoritative DNS, proxy and edge protection; storage of the external backup copy of the control database | IP address and request metadata; encrypted copy of account, workspace and billing data | United States |
| Let’s Encrypt (ISRG) | Issuance of TLS certificates for domains | Domain names | United States |
| Google (Gemini) | Automated summaries of build and deployment failures | Execution logs, which may contain code excerpts and file paths | United States |
The backup stored with Cloudflare is encrypted before it leaves our infrastructure; the key is not shared with the provider. It contains account, workspace and billing data — not the contents of your databases, buckets and volumes.
3. Communication and billing
| Subprocessor | Purpose | Data involved | Country |
|---|---|---|---|
| Resend | Delivery of transactional and service emails | Name, email address, message content | United States |
| Asaas | Payment and subscription processing and service invoice (NFS-e) issuance | Name, email, CPF or CNPJ, phone, address and payment data, collected directly by the processor | Brazil |
Credit card data is collected and processed directly by the payment processor. We do not store it.
4. Identity and integrations
Activated only when you choose to use them.
| Subprocessor | Purpose | Data involved | Country |
|---|---|---|---|
| GitHub | Authentication, repository reads and deployment webhooks | Account identifier, username, email, contents of the authorized repository | United States |
| GitLab | Authentication, repository reads and deployment webhooks | Account identifier, username, email, contents of the authorized repository | United States |
| Authentication via Google account | Account identifier, name, email, profile picture | United States |
5. Audience and advertising
Activated only after your consent, as described in the Cookie Policy. They operate only on the public website and dashboard and have no access to Customer Content.
| Subprocessor | Purpose | Data involved | Country |
|---|---|---|---|
| Google Analytics | Aggregate audience metrics | Cookie identifier, IP address, pages visited | United States |
| Google Ads | Campaign conversion measurement | Cookie identifier, conversion event | United States |
| Meta | Conversion measurement and advertising audiences | Cookie identifier, conversion event | United States |
6. International transfers
Subprocessors based abroad process data under article 33 of the LGPD, through contractual data protection clauses and, where applicable, on the basis of necessity for performance of the contract. Details are in section 6 of the Privacy Policy.
7. Changes and objection
We will announce the addition of a new subprocessor, or the replacement of an existing one, 30 days in advance, by email and on this page.
If you are a Controller under the DPA and have a reasonable, substantiated objection to a new subprocessor, notify us within 30 days at contato@upuai.com.br. We will seek an alternative; if none is feasible, you may terminate the affected portion of the service with a pro-rata refund of the paid, unused period.
This list was last reviewed on July 30, 2026.
GMB TECNOLOGIA LTDA — CNPJ 68.727.144/0001-88 — Belo Horizonte/MG, Brazil.