What are sub-processors?
Sub-processors are third parties that process personal data on behalf of Vytrix. Under the GDPR we are obliged to identify them, conclude a processing agreement (DPA) with them, and make changes to this list at least 30 days before effective date to announce.
Do you object to a new sub-processor on data protection grounds? Contact us at privacy@vytrix.app before the effective date.
Current sub-processors (August 2026)
| Sub-processor | Goal | Location | Transfer mechanism |
|---|---|---|---|
| Supabase Inc. | Database, Auth, Storage and backend Edge Functions | Primary Project Region for Database, Auth, and Storage: EU (Ireland — AWS eu-west-1); other processing according to the Supabase conditions | DPA + SCCs |
| Amazon Web Services (AWS) | Cloud infrastructure (sub-processor of Supabase) | Primary project infrastructure EU (Ireland); support and other processing according to the Supabase DPA | Via Supabase DPA |
| Google Ireland Limited (Firebase Crashlytics + Cloud Messaging) | Crash reporting and push notifications | EU + cross-border | EU-US DPF+ Google DPA with SCCs |
| RevenueCat Inc. | Subscription management and IAP entitlements | USA | EU-US DPF+ RevenueCat DPA with SCCs |
| Stripe Payments Europe, Ltd. | Payment processing (web checkout and affiliate payouts) | EU (Ireland) / US | EU-US DPF+ Stripe DPA with SCCs |
| Google Cloud (Vertex AI) | AI Coach (chat) and photo analysis of meals/products | EU multi-region (eu) | Google Cloud DPA + configured EU processing |
| OpenAI | Reading nutrition label, ingredient and optional product photos in the product label scanner | International processing | DPA + SCCs where applicable |
| Apple Inc. (App Store, IAP, Sign in with Apple) | App distribution and authentication | US/EU | DPF + Apple Developer Agreement |
| Google LLC (Google Play, Play Billing, Sign in with Google) | App distribution and authentication | US/EU | DPF + Google Play Developer Distribution Agreement |
| Resend (Plus Five Five, Inc.) | Double opt-in confirmation and, only after confirmation, scale product updates | US (primary processing and storage) | Resend DPA + EU-US DPF + SCCs |
| Vercel Inc. | Website hosting, Vercel Analytics and Speed Insights | EU + international infrastructure | DPA + SCCs where applicable |
| PostHog Inc. | Optional website product analytics, only after explicit permission | EU cloud endpoint + international service provider | DPA + SCCs where applicable |
For scaling interest via the app or website, Supabase stores the email address, individual product, intent, source, locale, optional country/region, consent version, and confirmation, unsubscribe, and provider acceptance metadata. Resend only receives what is necessary for recipient, email content and delivery. Training, health, nutrition and cycle data do not go to Resend. Only completed double-opt-in records that have not been unsubscribed will be allowed to receive product updates later.
Which data goes to which sub-processor?
| Category | Supabase | Firebase | RevenueCat | Vertex AI |
|---|---|---|---|---|
| Account (name, email) | Yes | ID only, for push | ID only, entitlements | No |
| Training dates | Yes | No | No | No |
| Nutrition dates | Yes | No | No | Only via photo AI |
| Sleep / body / heart rate | Yes | No (excluded from Crashlytics keys) | No | Only if user prompt |
| Progress photos | Yes (private bucket) | No | No | No |
| Meal photos / Vertex product photos | No (short-term in memory) | No | No | Yes (short-lived, not kept - EU) |
| Menstrual cycle | Yes (Ireland primary project region) | No | No | No |
| Social content | Yes | No | No | No |
| Crash logs (no PII / no health) | No | Yes | No | No |
| Subscription transactional data | Entitlement state | No | Yes | No |
Outside of this compact matrix, the product label scanner can send photos of the label, the ingredients list and the front of the packaging, plus any barcode and existing product name, to OpenAI. Vercel processes website traffic and technical performance data. PostHog only processes cleared website events after explicit permission; URL queries and snippets are not included and legal pages are excluded.
Special guarantees per sub-processor
Supabase — Art. 9 health data
- Vytrix has obtained/requested written acknowledgment that processing of Art. 9 health data falls within the agreed scope
- The primary project region for Database, Auth and Storage is Ireland (
eu-west-1). Backups, support and other processing are subject to the current Supabase DPA and sub-processor conditions; this is not an absolute EU-only guarantee.
Firebase Crashlytics — exclusion of health data
- IP collection is disabled
- Contain custom keys and logs geen personal training, health, nutrition, or cycle data
- Only technical fields (app version, OS version, device model) and pseudonymised user_id
RevenueCat — exclusion of Art. 9
- RevenueCat's DPA prohibits Art. 9 data
- We only send attribute IDs and transactional data; no link to health data or cycle data
Google Vertex AI — EU residency + metadata strip
- Processing via the EU multi-region
eu; Vertex AI does not use prompts or images for model training - EXIF metadata is stripped from photos before upload
- No account identifiers or email addresses in prompts
- Foto-AI has a kill switch flag for global disablement
OpenAI — product label scanner
- Only the product photos and necessary context chosen by the user (possibly barcode and existing product name) are sent for this scan; no account ID or email address.
- International processing is subject to applicable DPA and onward transfer safeguards.
Vercel and PostHog — website
- Vercel provides website hosting and cookie-free technical web statistics; URL queries and snippets are removed.
- PostHog is only loaded after explicit permission. DNT and Global Privacy Control count as a refusal; legal pages do not use PostHog.
Resend — minimum mail dates and US transfer
- Primary processing and storage takes place in the US; a European shipping region does not change the storage location.
- Transfers are based on the Resend DPA, DPF and SCCs.
- Only double-opt-in confirmed, unsubscribed records are allowed to receive updates. Each update contains a personal unsubscribe link that immediately revokes consent; Signing up again requires a new double opt-in.
How do we handle changes?
- New sub-processor: publication at least 30 days in advance on this page + email notification to registered users.
- Objection: via privacy@vytrix.app. In the event of a well-founded objection, we will look for an alternative; If that doesn't work, you can cancel your account with a refund of prepaid subscription fees.
- Change of location or transfer mechanism: publication + email.
- Removal of a sub-processor: publication; data will be deleted or returned by the processor within 90 days.
Contact
Questions about sub-processors? privacy@vytrix.app