Osum procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ 7. Transfer of Data” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 6. Retention of Data” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Fastlane is provided by Google, Inc. Fastlane is a continuous delivery tool for iOS and Android apps. For more information on what data Fastlane collects for what purpose and how the protection of the data is ensured, please visit the Google Privacy Policy page: https://policies.google.com/privacy ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may use third-party Service Providers to show advertisements to you to help support and maintain our Service.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Cloudflare analytics is a web analytics service operated by Cloudflare Inc. Read the Privacy Policy here: https://www.cloudflare.com/privacypolicy/ ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We may provide paid products and/or services within Service. In that case, we use third-party services for payment processing (e.g. payment processors). We will not store or collect your payment card details. That information is provided directly to our third-party payment processors whose use of your personal information is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information. The payment processors we work with are: PayPal or Braintree: Their Privacy Policy can be viewed at https://www.paypal.com/webapps/mpp/ua/privacy-full FastSpring: Their Privacy Policy can be viewed at https://fastspring.com/privacy/ Apple Store In-App Payments: Their Privacy Policy can be viewed at https://www.apple.com/legal/privacy/en-ww/ / https://support.apple.com/en-us/HT203027 Google Play In-App Payments: Their Privacy Policy can be viewed at https://policies.google.com/privacy?hl=en&gl=us / https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=privacynotice&ldl=en Stripe: Their Privacy Policy can be viewed at https://stripe.com/us/privacy 2Checkout: Their Privacy Policy can be viewed at https://www.2checkout.com/legal/privacy/ Adyen: Their Terms and conditions can be viewed at https://www.adyen.com/legal/terms-and-conditions Alipay: Their Privacy Policy can be viewed at https://render.alipay.com/p/f/agreementpages/alipayglobalprivacypolicy.html Authorize.net: Their Privacy Policy can be viewed at https://www.authorize.net/about-us/privacy/ Elavon: Their Privacy Policy can be” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ For more information on what type of information Weblate collects, please visit their Privacy Policy page: https://weblate.org/en/terms/ ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Crowdin is a cloud-based solution that streamlines localization management to effectively manage all of your multilingual content. For more information on what data Crowdin collects for what purpose and how the protection of the data is ensured, please visit Crowdin Privacy Policy page: https://crowdin.com/privacy-policy/#16-how-to-contact-us ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Codemagic is provided by Nevercode LTD. Codemagic is the official CI/CD solution dedicated just for Flutter apps. For more information on what data Codemagic collects for what purpose and how the protection of the data is ensured, please visit their Terms and conditions page: https://codemagic.io/terms/ ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Rollbar is error tracking service provided by Rollbar Inc. Find out more here: https://docs.rollbar.com/docs/privacy-policy ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Statcounter is a web traffic analysis tool. You can read the Privacy Policy for Statcounter here: https://statcounter.com/about/legal/ ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may use third-party Service Providers to automate the development process of our Service.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ viewed at https://www.elavon.com/privacy-pledge.html First Data: Their Privacy Policy can be viewed at https://www.firstdata.com/en_us/privacy.html Go Cardless: Their Privacy Policy can be viewed at https://gocardless.com/legal/privacy Klarna: Their Services Terms, Privacy Policy and Buyer Protection Policy can be viewed at https://www.klarna.com/us/legal/ Moneris: Their Privacy Policy can be viewed at https://www.moneris.com/legal/privacy-policy Plaid: Their End User Privacy Policy, Cookie Policy and Privacy Statement can be viewed at https://plaid.com/legal/ Sage Pay: Their Privacy Policy can be viewed at https://www.sagepay.co.uk/policies/privacy-policy Square: Their Privacy Policy can be viewed at https://squareup.com/us/en/legal/general/privacy Verifone: Their Privacy Policy can be viewed at https://www.verifone.com/en/privacy WeChat: Their Privacy Policy can be viewed at https://www.wechat.com/en/privacy_policy.html ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Twitter remarketing service is provided by Twitter Inc. You can opt-out from Twitter's interest-based ads by following their instructions: https://support.twitter.com/articles/20170405 You can learn more about the privacy practices and policies of Twitter by visiting their Privacy Policy page: https://twitter.com/privacy ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Fathom Analytics is analytics service provided by Conva Ventures Inc. You can find their Privacy Policy here: https://usefathom.com/privacy/ ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ AdButler is an advertising service provided by Sparklit Networks Inc. For more information about AdButler, please visit their Privacy Policy: https://www.sparklit.com/agreements.spark?agreement=privacy ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 8. Disclosure of Data” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ CircleCI is provided by Circle Internet Services, Inc. CircleCI is Continuous Integration, a development practice which is being used by software teams allowing them to build, test and deploy applications easier and quicker on multiple platforms. For more information on what data Circle CI collects for what purpose and how the protection of the data is ensured, please visit Circle CI Privacy Policy page: https://circleci.com/privacy/ ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Bugsnag is a platform for monitoring and logging stability of applications provided by Bugsnag Inc. Please read their Privacy Policy here: https://docs.bugsnag.com/legal/privacy-policy/ ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Clicky is a web analytics service. Read the Privacy Policy for Clicky here: https://clicky.com/terms ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Unity Ads is provided by Unity Technologies. You can opt-out from Unity Ads service by following the instructions as described by Unity Technologies on their Privacy Policy page: https://unity3d.com/legal/privacy-policy For more information about Unity Technologies, please visit Unity Technologies Privacy Policy: https://unity3d.com/legal/privacy-policy ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may employ third party companies and individuals to facilitate our Service ( “Service Providers” ), provide Service on our behalf, perform Service-related services or assist us in analysing how our Service is used. These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Firebase Crashlytics is bug reporting service provided by Google Inc. You may opt-out of certain Firebase features through your mobile device settings, such as your device advertising settings or by following the instructions provided by Google in their Privacy Policy: https://policies.google.com/privacy?hl=en For more information on what type of information Firebase collects, please visit the Google Privacy Terms web page: https://policies.google.com/privacy?hl=en ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Codecov provides highly integrated tools to group, merge, archive and compare coverage reports. For more information on what data Codecov collects for what purpose and how the protection of the data is ensured, please visit their Privacy Policy page: https://codecov.io/privacy ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ There may be a variety of other third-party Service Providers we use to monitor and analyze the use of our Service and we reserve the right to remove, add, edit, change or update our use of any services at any time” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Unity Analytics is provided by Unity Technologies. For more information on what type of information Unity Analytics collects, please visit their Privacy Policy page: https://unity3d.com/legal/privacy-policy ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualise and personalise the ads of its own advertising network. For more information on the privacy practices of Google, please visit the Google Privacy Terms web page: https://policies.google.com/privacy?hl=en We also encourage you to review the Google's policy for safeguarding your data: https://support.google.com/analytics/answer/6004245 .” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Flurry Analytics service is provided by Yahoo! Inc. You can opt-out from Flurry Analytics service to prevent Flurry Analytics from using and sharing your information by visiting the Flurry's Opt-out page: https://dev.flurry.com/secure/optOut.do For more information on the privacy practices and policies of Yahoo!, please visit their Privacy Policy page: https://policies.yahoo.com/us/en/yahoo/privacy/policy/index.htm ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ GitLab CI/CD is provided by GitLab, Inc. GitLab CI (Continuous Integration) service is a part of GitLab that build and test the software whenever developer pushes code to application. GitLab CD (Continuous Deployment) is a software service that places the changes of every code in the production which results in every day deployment of production. For more information on what data GitLab CI/CD collects for what purpose and how the protection of the data is ensured, please visit GitLab CI/CD Privacy Policy page: https://about.gitlab.com/privacy/ ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Piwik or Matomo is a web analytics service. You can visit their Privacy Policy page here: https://matomo.org/privacy-policy ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Azure DevOps is a Software as a service (SaaS) platform from Microsoft that provides an end-to-end DevOps toolchain for developing and deploying software. You can find Microsoft Privacy Statement here: https://privacy.microsoft.com/en-gb/privacystatement ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Firebase is analytics service provided by Google Inc. You may opt-out of certain Firebase features through your mobile device settings, such as your device advertising settings or by following the instructions provided by Google in their Privacy Policy: https://policies.google.com/privacy?hl=en For more information on what type of information Firebase collects, please visit the Google Privacy Terms web page: https://policies.google.com/privacy?hl=en ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ If you wish to purchase any product or service made available through Service ( “Purchase” ), you may be asked to supply certain information relevant to your Purchase including, without limitation, your credit card number, the expiration date of your credit card, your billing address, and your shipping information. You represent and warrant that: (i) you have the legal right to use any credit card(s) or other payment method(s) in connection with any Purchase; and that (ii) the information you supply to us is true, correct and complete. We may employ the use of third party services for the purpose of facilitating payment and the completion of Purchases. By submitting your information, you grant us the right to provide the information to these third parties subject to our Privacy Policy. We reserve the right to refuse or cancel your order at any time for reasons including but not limited to: product or service availability, errors in the description or price of the product or service, error in your order or other reasons. We reserve the right to refuse or cancel your order if fraud or an unauthorized or illegal transaction is suspected.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Sentry is open-source error tracking solution provided by Functional Software Inc. More information is available here: https://sentry.io/privacy/ ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Raygun is automated error monitoring software provided by Raygun Limited. Privacy Policy is accessible at https://raygun.com/privacy/ ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ AdMob by Google is provided by Google Inc. You can opt-out from the AdMob by Google service by following the instructions described by Google: https://support.google.com/ads/answer/2662922?hl=en For more information on how Google uses the collected information, please visit the “How Google uses data when you use our partners' sites or app” page: http://www.google.com/policies/privacy/partners/ or visit the Privacy Policy of Google: http://www.google.com/policies/privacy/ ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Yodo1 is a service provided by Yodo1, Ltd. For more information on what type of information Yodo1 collects, please visit their Privacy Policy page: https://www.yodo1.com/privacy ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ GitHub is provided by GitHub, Inc. For more information on what data GitHub collects for what purpose and how the protection of the data is ensured, please visit GitHub Privacy Policy page: https://help.github.com/en/articles/github-privacy-statement ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may use third-party Service Providers to monitor and analyze the use of our Service.” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.