Sub‑processors

Last updated: October 2, 2026

We engage the following service providers as sub‑processors to support hosting, infrastructure, authentication, storage, AI, crash reporting, push notifications, and subscriptions. Each processes personal information on our behalf under contractual obligations, including confidentiality and data protection commitments.

Vercel, Inc.

  • Role: Hosting, CDN, build/deploy platform
  • Primary locations: EU/US (regions vary by deployment configuration)
  • Transfer mechanism: EU Standard Contractual Clauses; UK IDTA/Addendum; Swiss adaptations; or Data Privacy Framework where applicable

Supabase

  • Role: Database, authentication, storage
  • Primary locations: Region selected during project setup (EU/US options); backups may be regional
  • Transfer mechanism: EU Standard Contractual Clauses; UK IDTA/Addendum; Swiss adaptations; regional hosting where available

Railway

  • Role: Application hosting and backend data processing
  • Primary locations: Deployment region selected by Mavr
  • Transfer mechanism: Contractual safeguards, including EU Standard Contractual Clauses where applicable

OpenAI

  • Role: AI inference for application features
  • Primary locations: US/EU depending on API configuration and model availability
  • Transfer mechanism: EU Standard Contractual Clauses; UK IDTA/Addendum; Swiss adaptations; or Data Privacy Framework where applicable

Google Cloud / Gemini

  • Role: AI inference for application features
  • Primary locations: Processing locations depend on the API configuration and model availability
  • Transfer mechanism: EU Standard Contractual Clauses and other applicable contractual safeguards

Functional Software, Inc. (Sentry)

  • Role: Crash and error reports from the app and servers, with personal and health data removed before sending
  • Primary locations: US
  • Transfer mechanism: EU Standard Contractual Clauses; UK IDTA/Addendum; Swiss adaptations; or Data Privacy Framework where applicable

650 Industries, Inc. (Expo)

  • Role: Delivering push notifications to your device (push token and notification text; no health data on the lock screen)
  • Primary locations: US
  • Transfer mechanism: EU Standard Contractual Clauses; UK IDTA/Addendum; Swiss adaptations; or Data Privacy Framework where applicable

RevenueCat, Inc.

  • Role: Managing App Store subscriptions and trials (account ID, purchase and renewal status)
  • Primary locations: US
  • Transfer mechanism: EU Standard Contractual Clauses; UK IDTA/Addendum; Swiss adaptations; or Data Privacy Framework where applicable

Featurebase

  • Role: Feedback and feature-request board (an anonymous name and ID only, never your email)
  • Primary locations: EU/US depending on configuration
  • Transfer mechanism: EU Standard Contractual Clauses where applicable

Services you choose to connect (Apple Health, Garmin, Strava, TrainingPeaks, intervals.icu, Runna) and Apple (Sign in with Apple and the App Store) act under their own terms and privacy policies, not as our sub-processors. Open-Meteo (weather), Open Food Facts (food data and photos) and Esri (map tiles on our website) receive only limited technical data, as described in our Privacy Policy.

We implement supplementary safeguards (e.g., encryption in transit and at rest, access controls, data minimization). We will update this list if we add or replace sub‑processors for relevant services.

Questions? Contact info@mavr.app.