What are sub-processors?
Sub-processors are third parties that process personal data on behalf of Vytrix. Under the GDPR we are required to identify them, sign a Data Processing Agreement (DPA), and announce changes at least 30 days before they take effect.
To object on data-protection grounds, contact privacy@vytrix.app before the effective date.
Current sub-processors (August 2026)
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Supabase Inc. | Database, Auth, Storage and backend Edge Functions | Primary project region for Database, Auth and Storage: EU (Ireland — AWS eu-west-1); other processing under the Supabase terms | DPA + SCCs |
| AWS | Cloud infrastructure (sub-processor of Supabase) | Primary project infrastructure in the EU (Ireland); support and other processing under the Supabase DPA | Via Supabase DPA |
| Google Ireland Limited (Firebase) | Crash reporting + push notifications | EU + cross-border | EU-US DPF + Google DPA + SCCs |
| RevenueCat Inc. | Subscription management, IAP entitlements | US | EU-US DPF + RevenueCat DPA + SCCs |
| Google Cloud (Vertex AI) | AI Coach (chat) + meal photo analysis | EU multi-region (eu) | Google Cloud DPA + configured EU processing |
| OpenAI | Reading nutrition-label, ingredients-list and optional front images in the product-label scanner | International processing | DPA + SCCs where applicable |
| Stripe Payments Europe, Ltd. | Web payments and affiliate payouts | EU + international processing | Stripe DPA + DPF/SCCs where applicable |
| Apple Inc. | App Store, IAP, Sign in with Apple | US / EU | DPF + Apple Developer Agreement |
| Google LLC | Google Play, Play Billing, Sign in with Google | US / EU | DPF + Google Play Developer Distribution Agreement |
| Resend (Plus Five Five, Inc.) | Double-opt-in confirmation and, only after confirmation, scale-product updates | US (primary processing and storage) | Resend DPA + EU-US DPF + SCCs |
| Vercel Inc. | Website hosting, Vercel Analytics and Speed Insights | EU + international infrastructure | DPA + SCCs where applicable |
| PostHog Inc. | Optional website product analytics, only after explicit consent | EU cloud endpoint + international provider | DPA + SCCs where applicable |
Which data goes to which sub-processor?
For the full data-mapping matrix, see the Dutch source at /subverwerkers#data-mapping. Key invariants:
- Health/fitness/nutrition data → primary storage in the Supabase Ireland project region; selected AI features send only the inputs described below to their named provider
- Menstrual cycle data → primary storage in the Supabase Ireland project region; Vytrix does not send it to AI, marketing or payment providers. Supabase infrastructure processing remains governed by its DPA and sub-processor terms
- Crash logs → Firebase Crashlytics; never include health-data fields
- Subscription transactional data → RevenueCat (US, DPF + SCCs); RevenueCat DPA forbids Art. 9 data
- Meal photos and Vertex-based product photos → Google Vertex AI (EU multi-region
eu— not used for model training); EXIF metadata stripped before upload; no account identifiers in prompts - Product-label scans → OpenAI may receive the selected label/ingredients/front images and, when available, a barcode and existing product name; no account ID or email address
- Scale-product interest through the app or website → Supabase stores email, separate product, intent, source, locale, optional country/region, consent version and confirmation, unsubscribe and provider-acceptance metadata. Resend receives only the recipient, mail content and delivery metadata; never health, training, nutrition or cycle data.
- Only completed double-opt-in records that have not unsubscribed may receive product updates. Every update includes a personal unsubscribe link; rejoining requires a new double opt-in. Resend's primary processing and storage are in the US; a European sending region does not change data residency.
- Website telemetry → Vercel processes hosting and cookieless performance events. PostHog receives sanitised events only after explicit consent; URL queries/fragments are removed, DNT/GPC are respected and legal pages are excluded.
How we handle changes
- New sub-processor: 30 days advance notice on this page + email to registered users.
- Object: via privacy@vytrix.app. If we cannot find an alternative, you may cancel with refund of prepaid subscription fees.
- Location/transfer change: publication + email.
- Sub-processor removed: publication; data deleted or returned within 90 days.
Contact
Questions about sub-processors? privacy@vytrix.app