Galu Sub-processors
Effective date: 27 October 2026
Version: 1.2
These are the service providers Galu uses to process personal data, for merchants and for the buyers who use merchants' recording pages. This list is published in Arabic and English. If the two versions differ, the Arabic version prevails. Galu is operated by Ahmed Mustafa, freelance document FL-657428298, Jeddah, Saudi Arabia.
1. Sub-processors
| Provider | Purpose | Data involved | Region |
|---|---|---|---|
| Supabase Inc. | Database, sign-in (including the sign-in emails for confirming an address and resetting a password), the server functions that run Galu, and storage of store logos | Merchant account details; submissions (the buyer's name, star rating and contact permission, where the buyer gave them, and, on submissions sent before this version took effect, an email address and caption); consent records, including the buyer's IP address and browser; store logos | Germany (Frankfurt, eu-central-1) |
| Cloudflare, Inc. (R2 storage) | Stores and serves the video, photo and thumbnail files that buyers send | Video and photo files, and video thumbnails | European Union (R2 EU jurisdiction) |
| Resend Inc. | Sends Galu's emails: new-submission alerts to merchants, and messages from the in-app support form to Galu's support mailbox | The merchant's email address and store name; in a new-submission alert, the buyer's name and star rating, if given; the content of support messages | European Union (Resend's EU sending region) |
| Vercel Inc. | Hosts the website, the dashboard and the recording page | The IP address and request details of every visitor, merchants and buyers included | United States company, with a global network that serves each request from a nearby location |
Galu uses each provider under that provider's data processing terms. All four are companies established in the United States; section 7.8 of the Terms of Service explains what that means.
Error reporting with Sentry is built into the app but is not switched on. If Galu switches it on, Sentry will be added to this list with the notice below.
2. Third parties in the browser
These are not sub-processors of merchants' buyer data. They run in a visitor's browser:
| Provider | Purpose | Data involved | Region |
|---|---|---|---|
| Google LLC (Google Analytics 4) | Website analytics on Galu's marketing pages only, and only after the visitor accepts analytics. Never on the recording page, the wall, the embed or the dashboard | A pseudonymous identifier, the pages visited, browser and device details, and an approximate location derived from the IP address | United States |
3. Changes to this list
Galu emails every merchant at least 14 days before adding or replacing a sub-processor. A merchant may object within those 14 days, and if Galu cannot address the objection, may end the service before the change takes effect, as section 7.7 of the Terms of Service sets out.
Questions: privacy@getgalu.com.