Back

    Sub-Processors

    Last updated: June 2026

    Introduction

    This page lists the third-party sub-processors that Pragathi Jayaram (doing business as Anovi Wellness) ("we," "us," or "our") engages to deliver the Anovi Wellness mobile application (the "App"). We maintain this page to keep the recipient disclosure required by Article 13(1)(e) of the General Data Protection Regulation (GDPR) accurate and as part of our commitment to transparency.

    What is a sub-processor? Under Article 28 GDPR, when we (the data controller) engage another entity to process personal data on our behalf, that entity is a sub-processor. Each sub-processor listed below operates under a Data Processing Agreement that obliges them to process your personal data only on our documented instructions and to maintain the security measures required by Article 32 GDPR.

    Scope. This list covers sub-processors used by the mobile App. For sub-processors used by our website (anoviwellness.com), please see Section 4 of our Website Privacy Policy. For full details on how we handle your data within the App, please see our App Privacy Policy.

    Our sub-processors

    The following third parties process personal data on our behalf:

    Supabase, Inc.

    • Role: Database, authentication, and file storage. Anovi Wellness's primary persistence layer for your account, profile, and in-app records.
    • Region: European Union (Frankfurt, AWS eu-central-1)
    • Transfer mechanism: Standard Contractual Clauses Module 2 (Commission Decision (EU) 2021/914)
    • Privacy policy: supabase.com/privacy

    Google LLC (Google Cloud, Vertex AI)

    • Role: AI-assisted nutrition estimation and meal-log assistance (Gemini language model). Customer prompts and responses are not used to train Google's foundation models, are not stored for model improvement, and are not subject to human review.
    • Region: European Union (Frankfurt, europe-west3)
    • Transfer mechanism: EU-U.S. Data Privacy Framework adequacy (Commission Decision (EU) 2023/1795); Standard Contractual Clauses as fallback
    • Privacy policy: policies.google.com/privacy

    Anthropic, PBC

    • Role: AI-assisted nutrition estimation (Claude language model) on the fallback path. Used only when our primary AI provider is unavailable. Anovi sends only the meal description and dietary context required for the estimate; no account identifiers are sent.
    • Region: United States
    • Transfer mechanism: Standard Contractual Clauses Module 2 (Commission Decision (EU) 2021/914) with documented supplementary measures (source-side pseudonymisation; fallback-only call path)
    • Privacy policy: anthropic.com/legal/privacy

    Railway Corporation

    • Role: Backend compute hosting for the Anovi API. All traffic between the App and our backend transits Railway in EU-West; Railway does not persist your data.
    • Region: European Union (Amsterdam, EU-West)
    • Transfer mechanism: EU-U.S. Data Privacy Framework adequacy (Commission Decision (EU) 2023/1795); Standard Contractual Clauses as fallback
    • Privacy policy: railway.com/legal/privacy

    Functional Software, Inc. (Sentry)

    • Role: Error monitoring and crash reporting. Sentry receives only pseudonymous identifiers and technical error metadata; Sentry is configured not to receive your name, email, health data, dietary preferences, meal logs, or message content. Sensitive request bodies and stack-frame variables are stripped before any event is sent.
    • Region: European Union (Frankfurt)
    • Transfer mechanism: EU-U.S. Data Privacy Framework adequacy (Commission Decision (EU) 2023/1795); Standard Contractual Clauses as fallback
    • Privacy policy: sentry.io/privacy

    Resend, Inc.

    • Role: Transactional email delivery: welcome email on signup, password-reset email, account-deletion confirmation, and relay of in-app support messages to our support inbox.
    • Region: European Union (Ireland, AWS)
    • Transfer mechanism: Standard Contractual Clauses Module 2 (Commission Decision (EU) 2021/914) as primary safeguard; EU-U.S. Data Privacy Framework adequacy (Commission Decision (EU) 2023/1795) as supplementary
    • Privacy policy: resend.com/legal/privacy-policy

    Zoho Corporation GMBH

    • Role: Customer support inbox (Zoho Mail). Receives emails sent to hello@anoviwellness.com, including support messages relayed from the App's in-app support form.
    • Region: European Union (Amsterdam, zoho.eu) for data hosting; contracting entity Zoho Corporation GMBH, II. Hagen 7, 45127 Essen, Germany.
    • Transfer mechanism: EU data residency (primary); Article 28 Standard Contractual Clauses (Commission Decision (EU) 2021/915) as Schedule 1 of our customer-named Data Processing Agreement; Chapter V transfer Standard Contractual Clauses (Commission Decision (EU) 2021/914) for limited group-entity support and debugging access from India, per DPA §5.2 and Schedule 2.
    • Privacy policy: zoho.com/privacy

    650 Industries, Inc. (Expo / EAS)

    • Role: Mobile application build infrastructure and over-the-air update delivery. Expo does not receive your account data; when your device checks for an app update it sends standard HTTP request metadata (IP address, device type, app version, and an installation identifier) to Expo's update servers.
    • Region: United States (build infrastructure); global content delivery network (update delivery)
    • Transfer mechanism: EU-U.S. Data Privacy Framework adequacy (Commission Decision (EU) 2023/1795); Standard Contractual Clauses as fallback
    • Privacy policy: expo.dev/privacy

    RevenueCat, Inc.

    • Role: In-app purchase and subscription management. RevenueCat validates your App Store and Google Play purchases, keeps your Anovi Pro subscription status in sync across your devices, and confirms to the App whether your Pro access is active. RevenueCat receives a pseudonymous account identifier together with purchase and subscription details; it does not receive your name, email address, health data, or payment-card details. Apple and Google process payment-card data as the sellers of the subscription; that data reaches neither RevenueCat nor Anovi.
    • Region: United States
    • Transfer mechanism: Standard Contractual Clauses Module 2 (Commission Decision (EU) 2021/914) with documented supplementary measures (source-side pseudonymisation; data minimisation)
    • Privacy policy: revenuecat.com/privacy

    Independent controllers

    Some third parties process personal data for their own purposes and not on our behalf. For example, Apple App Store and Google Play may process app download, purchase, subscription, device, account, and store analytics data under their own terms and privacy notices. They are not listed above because they are not Anovi processors. Anovi remains responsible for any account, subscription-status, or entitlement data that we receive and use within the App.

    Changes to this list

    We may add, replace, or change the role of a sub-processor. We update this page when that happens. We also update our App Privacy Policy for material changes, in line with Section 15 of that policy. If you have concerns about a new processor, you may contact us at hello@anoviwellness.com.

    How to contact us

    For questions about how we handle your personal data, including any of the sub-processors above, you may email us at hello@anoviwellness.com or contact us by post at:

    Pragathi Jayaram
    Karlsruher Straße 32
    70771 Leinfelden-Echterdingen
    Germany

    Definitions

    • Standard Contractual Clauses (SCCs): pre-approved data-protection clauses adopted by the European Commission (Decision 2021/914) that provide appropriate safeguards for transfers of personal data outside the European Union.
    • EU-U.S. Data Privacy Framework (DPF): an adequacy framework under Commission Decision (EU) 2023/1795. The European Commission has determined that organisations self-certified under the DPF provide an adequate level of protection for personal data transferred from the EU to the United States.
    • Sub-processor: a third party engaged by the data controller (Anovi Wellness) to process personal data on the controller's behalf, under contractual obligations equivalent to those the controller accepts towards the data subject.
    • Controller / Processor: defined in Article 4 GDPR. Anovi Wellness is the controller of personal data processed within the App. The entities listed above are processors.