What are sub-processors?
Sub-processors are third parties that process personal data on behalf of Vytrix. Under the GDPR we are required to identify them, sign a Data Processing Agreement (DPA), and announce changes at least 30 days before they take effect.
To object on data-protection grounds, contact privacy@vytrix.app before the effective date.
Current sub-processors (May 2026)
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Supabase Inc. | Database, Auth, Storage, Edge Functions | EU (Ireland — AWS eu-west-1) | DPA + SCCs |
| AWS | Cloud infrastructure (sub-processor of Supabase) | EU (Ireland) | Via Supabase DPA |
| Google Ireland Limited (Firebase) | Crash reporting + push notifications | EU + cross-border | EU-US DPF + Google DPA + SCCs |
| RevenueCat Inc. | Subscription management, IAP entitlements | US | EU-US DPF + RevenueCat DPA + SCCs |
| OpenAI | AI Coach (chat) + meal photo analysis | US | EU-US DPF + OpenAI DPA + SCCs + Zero Data Retention |
| Apple Inc. | App Store, IAP, Sign in with Apple | US / EU | DPF + Apple Developer Agreement |
| Google LLC | Google Play, Play Billing, Sign in with Google | US / EU | DPF + Google Play Developer Distribution Agreement |
| Resend / Postmark (TBD — EU-region) | Transactional email | EU-region | DPA + EU-residency |
Which data goes to which sub-processor?
For the full data-mapping matrix, see the Dutch source at /subverwerkers#data-mapping. Key invariants:
- Health/fitness/nutrition data → Supabase only (EU)
- Menstrual cycle data → Supabase only, EU-only, never to OpenAI or any third party
- Crash logs → Firebase Crashlytics; never include health-data fields
- Subscription transactional data → RevenueCat (US, DPF + SCCs); RevenueCat DPA forbids Art. 9 data
- Meal/product photos → OpenAI (US, DPF + SCCs + ZDR); EXIF metadata stripped before upload; no account identifiers in prompts
How we handle changes
- New sub-processor: 30 days advance notice on this page + email to registered users.
- Object: via privacy@vytrix.app. If we cannot find an alternative, you may cancel with refund of prepaid subscription fees.
- Location/transfer change: publication + email.
- Sub-processor removed: publication; data deleted or returned within 90 days.
Contact
Questions about sub-processors? privacy@vytrix.app