Draft — to be reviewed by counsel before launchThis page is a working draft. It isn’t final legal text yet, and the highlighted placeholders still need details from the company or its lawyer.
Sub-processors
Last updated:
Current sub-processors
| Provider | What they do for Holimo | Data involved | Location and safeguard |
|---|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | All synced account and app data (journal and cycle data arrive already encrypted) | EU (Frankfurt); data processing agreement |
| Google (Gemini API, paid tier) | Holimo Pro AI features only | Minimal context for each request; never journal text; cycle data only with your opt-in | To fill in region and transfer safeguard, e.g. SCCs or EU-US Data Privacy Framework |
| RevenueCat | Subscription status across the App Store and Google Play | Anonymous account id, purchase and subscription records (no card details) | US; To fill in transfer safeguard |
| Apple | App Store distribution, in-app purchases, Sign in with Apple | Purchase and sign-in data under Apple’s own terms. Apple Health data stays on your phone | Under Apple’s terms |
| Google Play distribution and billing, Google sign-in | Purchase and sign-in data under Google’s own terms. Health Connect data stays on your phone | Under Google’s terms | |
| To fill in email provider | Sending sign-in codes and service emails | Email address | To fill in |
| Vercel | Hosting getholimo.com and running the waitlist function, which passes sign-ups on without storing them | Standard request logs (IP address, browser); waitlist email addresses in transit | To fill in confirm plan, region and transfer safeguard (data processing addendum) |
| To fill in waitlist provider, e.g. an email or automation service | Storing waitlist sign-ups and sending the launch email | Email address, the page you signed up on, the notice version you saw, time | To fill in |
Amazon and Myprotein are not sub-processors. Holimo sends them no personal data; when you tap a shop button you go to their site, where their policies apply. See our Affiliate Disclosure.
Changes
We update this page before adding a new sub-processor that handles personal data, and change the date above. Where the law requires, we will tell you in the app in advance.