Sub-processors
We use the following services to operate Yedeni. A data processing agreement under Art. 28 GDPR is in place with every processor. The recipients marked as independent controllers — Apple and Google for sign-in, purchases and advertising, Apple additionally for push delivery to iPhones — process under their own privacy notices; the basis is your use of the respective service or, for advertising, your consent. This list forms part of the Privacy notice and is updated whenever it changes.
We give notice of new or replaced providers before they process personal data — for material changes additionally in the app. We answer questions about individual providers at datenschutz@yedeni.com.
Overview
| Service | Role | Purpose | Location | Requires consent |
|---|---|---|---|---|
| Supabase Pte. Ltd. | Processor | Registration and sign-in (Auth), primary PostgreSQL database | EU (Frankfurt am Main, Germany) | No |
| Vercel Inc. | Processor | Operating the backend API (serverless functions), serving these legal pages, hosting the website yedeni.com | EU (Frankfurt am Main, region fra1) | No |
| Microsoft Ireland Operations Ltd. (Microsoft Azure) | Processor | Storing media (Blob Storage), delivery via the content-delivery network (Front Door, cdn.yedeni.com), media processing (Azure Functions: audio and frame extraction, video transcoding) | EU (West Europe region, Netherlands) | No |
| OpenAI Ireland Ltd. / OpenAI OpCo, LLC | Processor | All AI features: coach chat, photo and label analysis, recipe generation and import, nutrition estimation, speech transcription, translation, semantic search (embeddings) and content moderation | United States | No |
| Upstash, Inc. | Processor | Technical cache and queue: request rate limiting, usage allowances for AI features (daily or weekly) and short-lived caching; via Upstash QStash also the timed distribution of background tasks per user — delivery of scheduled push notifications, creation of the coach's daily insights and of the weekly review “Your week”, and the nightly update of taste profiles for meal and recipe suggestions | EU | No |
| Functional Software, Inc. (Sentry) | Processor | Crash and error diagnostics, performance regression detection | EU (German region, ingest.de.sentry.io) | No |
| PostHog, Inc. | Processor | Product analytics and app improvement; server-side reach measurement for the website yedeni.com | EU (Frankfurt am Main, eu.i.posthog.com) | Yes* |
| RevenueCat, Inc. | Processor | Subscription management: purchase validation, term and cancellation status, purchase restoration | United States | No |
| Google Ireland Ltd. (AdMob, User Messaging Platform) | Independent controller | Serving ads in the free Yedeni Basic tier and obtaining the required consent through Google's consent form (IAB Transparency and Consent Framework) | EU and United States | Yes |
| Google Ireland Ltd. (Anmeldung mit Google) | Independent controller | Sign-in via a Google account, if you choose that option | EU and United States | No |
| Apple Distribution International Ltd. | Independent controller | Sign in with Apple, App Store purchases, push delivery (APNs), access to Apple Health after you allow it | Ireland (EU) | No |
| Google Ireland Ltd. / Google Commerce Ltd. (Google Play, Health Connect) | Independent controller | Purchases via Google Play (Google Commerce Limited sells the subscription in its own name), access to Health Connect after you allow it | EU and United States | No |
| Google Ireland Ltd. / Google LLC (Firebase Cloud Messaging) | Processor | Delivering push notifications to Android devices | EU and United States | No |
| 650 Industries, Inc. (Expo / EAS) | Processor | Sending push notifications and delivering app updates | United States | No |
| Apify Technologies s.r.o. | Processor | Technically retrieving publicly available Instagram posts from partners who expressly permitted us to use their content | Czech Republic (EU) | No |
| Secret Industries Pty Ltd (FatSecret Platform API) | Processor | Supplementary food and barcode database when a product is found neither locally nor in Open Food Facts | Australia | No |
| TypeSafe AI, Inc. | Processor | Plausibility check of the coach's dish suggestions: whether a suggested dish is something people actually eat | United States | No |
| GitHub, Inc. | Processor | Running the nightly database backup (the backups themselves are stored in Azure's EU storage) and triggering internal load tests (control parameters only, no personal data) | United States | No |
| Brevo SAS | Processor | Delivery of system and information emails, plus aggregate performance measurement; receiving support emails including attachments and handing them to our ticket system | France and Germany (EU) | No |
| Discord Inc. | Independent controller | Internal notification of our team about new and open support cases | United States | No |
| Google Cloud EMEA Ltd. (Google Workspace) | Processor | Our mailboxes @yedeni.com (receiving and handling support, privacy and other enquiries) and sending the account emails of the sign-in service, for example to confirm your email address or to reset your password | EU and United States | No |
Details
Supabase Pte. Ltd.
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Registration and sign-in (Auth), primary PostgreSQL database |
| Data | Email address, password hash, sign-in timestamps, all content and health data stored in the app |
| Processing location | EU (Frankfurt am Main, Germany) |
| Basis | Standard contractual clauses (Art. 46(2)(c) GDPR). Data is stored exclusively in the EU region (Frankfurt). The contracting party is Supabase Pte. Ltd., based in Singapore; access from third countries for operations and support (Singapore, United States) is covered by the standard contractual clauses (Module 2) agreed with Supabase's terms. There is no adequacy decision of the European Commission for Singapore. |
| Requires consent | No — required to operate the service |
Vercel Inc.
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Operating the backend API (serverless functions), serving these legal pages, hosting the website yedeni.com |
| Data | IP address, timestamp, requested endpoints and the full contents of each request while it is processed |
| Processing location | EU (Frankfurt am Main, region fra1) |
| Basis | Adequacy decision (Art. 45 GDPR, EU-U.S. Data Privacy Framework) plus standard contractual clauses. The execution region is pinned to Frankfurt. The provider is US-based and certified under the EU-U.S. Data Privacy Framework; this covers access from the US for operations and support. |
| Requires consent | No — required to operate the service |
Microsoft Ireland Operations Ltd. (Microsoft Azure)
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Storing media (Blob Storage), delivery via the content-delivery network (Front Door, cdn.yedeni.com), media processing (Azure Functions: audio and frame extraction, video transcoding) |
| Data | Uploaded photos and videos, profile pictures, voice recordings; CDN requests additionally involve IP address and timestamp |
| Processing location | EU (West Europe region, Netherlands) |
| Basis | Adequacy decision (Art. 45 GDPR, EU-U.S. Data Privacy Framework) plus standard contractual clauses. Data is stored in the EU West Europe region. Access by Microsoft Corporation (US) for operations and support is covered by the adequacy decision on the EU-U.S. Data Privacy Framework and the standard contractual clauses in Microsoft's data protection addendum. |
| Requires consent | No — required to operate the service |
OpenAI Ireland Ltd. / OpenAI OpCo, LLC
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | All AI features: coach chat, photo and label analysis, recipe generation and import, nutrition estimation, speech transcription, translation, semantic search (embeddings) and content moderation |
| Data | The contents of each request: chat messages, meal and label photos, voice recordings, recipe text, for the pre-check of a submitted recipe also its cover image and other photos, and the slice of nutrition goals, daily balance, allergies, preferences, weight history and activity needed for the answer — steps, active energy and today's workouts (type, duration, energy, start), including from Apple Health or Health Connect, without the name of the app that recorded a workout — including health data. No account or user identifier is transmitted. |
| Processing location | United States |
| Basis | Standard contractual clauses (Art. 46(2)(c) GDPR). OpenAI is not certified under the EU-U.S. Data Privacy Framework; the onward transfer from OpenAI Ireland Ltd. to OpenAI OpCo, LLC in the United States relies on the standard contractual clauses in the data processing agreement. Data submitted through the API is contractually excluded from model training. OpenAI keeps requests and responses for up to 30 days for abuse monitoring and may hold parts of a request for up to 24 hours in a cache limited to our account (prompt cache). This is the only recipient to which we regularly transfer health data for processing outside the EU — the transfer therefore additionally requires your explicit consent under Art. 9(2)(a) in conjunction with Art. 49(1)(a) GDPR, which points out the remaining risk (privacy notice section 6.3). |
| Requires consent | No — required to operate the service |
Upstash, Inc.
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Technical cache and queue: request rate limiting, usage allowances for AI features (daily or weekly) and short-lived caching; via Upstash QStash also the timed distribution of background tasks per user — delivery of scheduled push notifications, creation of the coach's daily insights and of the weekly review “Your week”, and the nightly update of taste profiles for meal and recipe suggestions |
| Data | Pseudonymous identifiers (user ID, IP address or push token), counters and content-free markers; for the queue also the kind of task and its time, for push notifications the time zone (as an offset from UTC) and, where applicable, the meal it is scheduled for — the service keeps these messages for at most 7 days in its logs and dead-letter queue. No names, no notification or insight texts, no content or health data. |
| Processing location | EU |
| Basis | Adequacy decision (Art. 45 GDPR, EU-U.S. Data Privacy Framework) plus standard contractual clauses. The provider is US-based and certified under the EU-U.S. Data Privacy Framework. The database and the queue run in the EU region; the adequacy decision and the clauses cover access by the provider from the US. |
| Requires consent | No — required to operate the service |
Functional Software, Inc. (Sentry)
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Crash and error diagnostics, performance regression detection |
| Data | Error messages, stack traces, app and device version, pseudonymous user ID. Email addresses, passwords, tokens and comparable values are stripped automatically before transmission. |
| Processing location | EU (German region, ingest.de.sentry.io) |
| Basis | Adequacy decision (Art. 45 GDPR, EU-U.S. Data Privacy Framework) plus standard contractual clauses. Reports are stored in the German region. The provider is US-based and certified under the EU-U.S. Data Privacy Framework; standard contractual clauses additionally cover access from the US. |
| Requires consent | No — required to operate the service |
PostHog, Inc.
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Product analytics and app improvement; server-side reach measurement for the website yedeni.com |
| Data | Pseudonymous device/user identifier, screens viewed, actions triggered, device class, OS and app version. No screen recordings, no health data, no plain-text content. Website: page, language, campaign details, referring domain, country, rough device type — without IP address or browser identifier, with a random identifier per request. |
| Processing location | EU (Frankfurt am Main, eu.i.posthog.com) |
| Basis | Adequacy decision (Art. 45 GDPR, EU-U.S. Data Privacy Framework) plus standard contractual clauses. Data is stored in Frankfurt. The contracting party is PostHog, Inc. (US), certified under the EU-U.S. Data Privacy Framework; this covers access from the US for operations and support. |
| Requires consent | Yes — only runs after your consent. Exception: the server-side reach measurement for the website yedeni.com (no device access) rests on legitimate interest, see privacy notice § 19. |
RevenueCat, Inc.
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Subscription management: purchase validation, term and cancellation status, purchase restoration |
| Data | Pseudonymous user ID, app-store purchase receipts, product and term data, country. No payment details — those stay with Apple and Google. |
| Processing location | United States |
| Basis | Standard contractual clauses (Art. 46(2)(c) GDPR). The provider is not certified under the EU-U.S. Data Privacy Framework; the standard contractual clauses in its data processing agreement apply. |
| Requires consent | No — required to operate the service |
Google Ireland Ltd. (AdMob, User Messaging Platform)
| Field | Value |
|---|---|
| Role | Independent controller — processes under its own privacy notice |
| Purpose | Serving ads in the free Yedeni Basic tier and obtaining the required consent through Google's consent form (IAB Transparency and Consent Framework) |
| Data | Device advertising ID, IP address, coarse location (country), ad interactions, consent status (TC string). Never health, nutrition or account data. |
| Processing location | EU and United States |
| Basis | Adequacy decision (Art. 45 GDPR, EU-U.S. Data Privacy Framework) plus standard contractual clauses. Google processes this data as an independent controller; there is no data processing agreement for it. Personalised ads only after your consent in the form. If you consent there only to storing and accessing information on your device, not to personalisation, you see non-personalised ads. If you decline, Google serves at most limited ads without device access and without the advertising ID — usually none. The advertising partners listed in the form receive data only to the extent you consent to them there; Yedeni embeds no other advertising SDK. Health data is never used for or transmitted for advertising. |
| Requires consent | Yes — only runs after your consent |
Google Ireland Ltd. (Anmeldung mit Google)
| Field | Value |
|---|---|
| Role | Independent controller — processes under its own privacy notice |
| Purpose | Sign-in via a Google account, if you choose that option |
| Data | Email address, name, Google account identifier |
| Processing location | EU and United States |
| Basis | Adequacy decision (Art. 45 GDPR, EU-U.S. Data Privacy Framework) plus standard contractual clauses. Google processes the sign-in as an independent controller under its own privacy notice; we receive only the details named. |
| Requires consent | No — required to operate the service |
Apple Distribution International Ltd.
| Field | Value |
|---|---|
| Role | Independent controller — processes under its own privacy notice |
| Purpose | Sign in with Apple, App Store purchases, push delivery (APNs), access to Apple Health after you allow it |
| Data | Apple account identifier, forwarded or anonymised email address where applicable, purchase receipts, push token |
| Processing location | Ireland (EU) |
| Basis | Processed inside the EU/EEA — no third-country transfer. Apple processes sign-in, purchases and push delivery as an independent controller under its own privacy notice. Apple Health data is read on your device only and forwarded to our backend only as daily values and individual workouts — we send no health data back to Apple. |
| Requires consent | No — required to operate the service |
Google Ireland Ltd. / Google Commerce Ltd. (Google Play, Health Connect)
| Field | Value |
|---|---|
| Role | Independent controller — processes under its own privacy notice |
| Purpose | Purchases via Google Play (Google Commerce Limited sells the subscription in its own name), access to Health Connect after you allow it |
| Data | Google account identifier, purchase receipts. Health Connect data is read locally on the device only and forwarded to our backend only as daily values and individual workouts — we send no health data to Google. |
| Processing location | EU and United States |
| Basis | Adequacy decision (Art. 45 GDPR, EU-U.S. Data Privacy Framework) plus standard contractual clauses. Google processes purchases as an independent controller under its own privacy notice. |
| Requires consent | No — required to operate the service |
Google Ireland Ltd. / Google LLC (Firebase Cloud Messaging)
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Delivering push notifications to Android devices |
| Data | The device's push token or installation identifier and the notification content (reminders, possibly a meal suggestion with portion and calorie figure — never weight, goals or diary values) |
| Processing location | EU and United States |
| Basis | Adequacy decision (Art. 45 GDPR, EU-U.S. Data Privacy Framework) plus standard contractual clauses. Google processes delivery as our processor under the Firebase Data Processing and Security Terms; Google LLC is certified under the EU-U.S. Data Privacy Framework. |
| Requires consent | No — required to operate the service |
650 Industries, Inc. (Expo / EAS)
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Sending push notifications and delivering app updates |
| Data | Device push token, notification content, app and runtime version when fetching updates |
| Processing location | United States |
| Basis | Standard contractual clauses (Art. 46(2)(c) GDPR). The standard contractual clauses (Module 2) form part of Expo's terms (section 3.2). Notification texts contain reminders and may carry a meal suggestion with portion and calorie figure; the weekly summary states how many meals you logged in the previous week and how many streaks are running. Your weight, goals and individual diary values are not transmitted. Delivery runs through Expo and the device vendor's service (Apple Push Notification Service or Firebase Cloud Messaging). |
| Requires consent | No — required to operate the service |
Apify Technologies s.r.o.
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Technically retrieving publicly available Instagram posts from partners who expressly permitted us to use their content |
| Data | Public post content and the partner's handle. No Yedeni user data is transmitted. |
| Processing location | Czech Republic (EU) |
| Basis | Processed inside the EU/EEA — no third-country transfer |
| Requires consent | No — required to operate the service |
Secret Industries Pty Ltd (FatSecret Platform API)
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Supplementary food and barcode database when a product is found neither locally nor in Open Food Facts |
| Data | Only the search term or barcode number. No user identifier, no health data. |
| Processing location | Australia |
| Basis | No personal data transmitted |
| Requires consent | No — required to operate the service |
TypeSafe AI, Inc.
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Plausibility check of the coach's dish suggestions: whether a suggested dish is something people actually eat |
| Data | Only the name and ingredient list of a dish suggestion generated by the coach. No chat messages, no user identifier. |
| Processing location | United States |
| Basis | No personal data transmitted |
| Requires consent | No — required to operate the service |
GitHub, Inc.
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Running the nightly database backup (the backups themselves are stored in Azure's EU storage) and triggering internal load tests (control parameters only, no personal data) |
| Data | The backup stream is processed during execution and not retained there. |
| Processing location | United States |
| Basis | Adequacy decision (Art. 45 GDPR, EU-U.S. Data Privacy Framework) plus standard contractual clauses |
| Requires consent | No — required to operate the service |
Brevo SAS
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Delivery of system and information emails, plus aggregate performance measurement; receiving support emails including attachments and handing them to our ticket system |
| Data | Email address, salutation/name, subject and body of the message, delivery events, IP address when images are loaded; for support emails to us also the sender name, headers and attachments |
| Processing location | France and Germany (EU) |
| Basis | Processed inside the EU/EEA — no third-country transfer. Health data is never processed by marketing email — this is enforced in code, not merely intended. The provider holds no contact list; it receives only the single recipient and the finished message per send, and for the inbox the incoming email. |
| Requires consent | No — required to operate the service |
Discord Inc.
| Field | Value |
|---|---|
| Role | Independent controller — processes under its own privacy notice |
| Purpose | Internal notification of our team about new and open support cases |
| Data | Only the case number (such as YD-1023), the category and the kind of event (new, replied, overdue). No names, addresses, subjects or message content — for Discord the details cannot be linked to any person. |
| Processing location | United States |
| Basis | No personal data transmitted. Discord processes the messages in our team channel under its own terms; it offers no data processing agreement for this, which is why nothing goes there that Discord could link to a person. |
| Requires consent | No — required to operate the service |
Google Cloud EMEA Ltd. (Google Workspace)
| Field | Value |
|---|---|
| Role | Processor (Art. 28 GDPR, data processing agreement in place) |
| Purpose | Our mailboxes @yedeni.com (receiving and handling support, privacy and other enquiries) and sending the account emails of the sign-in service, for example to confirm your email address or to reset your password |
| Data | Sender and recipient address, name, subject, content and attachments of emails to and from us; for account emails your email address and the confirmation or sign-in link |
| Processing location | EU and United States |
| Basis | Adequacy decision (Art. 45 GDPR, EU-U.S. Data Privacy Framework) plus standard contractual clauses. Data processing agreement: Google's Cloud Data Processing Addendum. Google LLC, as sub-processor, is certified under the EU-U.S. Data Privacy Framework. |
| Requires consent | No — required to operate the service |
Not used
For clarity, because we are often asked: we embed no advertising SDK other than Google AdMob. The advertising partners listed in the consent form (the IAB Transparency and Consent Framework vendor list) receive data only to the extent you consent to them there — if you decline, none of them does. We operate no cross-device tracking, sell no data to data brokers, and use no service that would analyse health data for advertising purposes.