naraa
    Processors

    Sub-Processor List

    Last updated: August 2026

    naraa is operated by naraa GmbH. Managing Director: Pidder Seidl This page is the authoritative sub-processor list for naraa. All other naraa documents refer to this page instead of repeating the list. It names the third-party service providers ("sub-processors") that may process personal data in connection with the naraa application, including providers that are in use and providers that are prepared for upcoming features. We may update this list as our infrastructure evolves.

    1. AI Processing

    OpenAI

    Purpose: AI language processing

    Data processed: User text input, system prompts

    Location: May involve international data transfers

    Whisper-based Speech Processing (via OpenAI or equivalent provider)

    Purpose: Speech-to-text transcription

    Data processed: Temporary audio input (not stored), text transcription

    ElevenLabs

    Purpose: Text-to-speech synthesis

    Data processed: AI-generated text output

    Location: United States, EU Standard Contractual Clauses

    xAI (Grok)

    Purpose: AI image generation

    Data processed: Image prompts, generation parameters

    Location: United States, EU Standard Contractual Clauses

    Google (Gemini, Veo)

    Purpose: Scene and video generation

    Data processed: Prompts, generation parameters

    Location: EU and United States, EU Standard Contractual Clauses

    fal.ai / Runware

    Purpose: Image generation infrastructure

    Data processed: Image prompts, generated media

    Location: EU and United States, EU Standard Contractual Clauses

    2. Infrastructure & Hosting

    Amazon Web Services (AWS)

    Purpose: Cloud infrastructure hosting

    Data processed: Application data, storage, system logs

    Supabase

    Purpose: Database services

    Data processed: User account data, chat records, stored content

    Location: EU region

    Lovable

    Purpose: Hosting of the naraa.ai website

    Data processed: Server logs, contact and waitlist form submissions

    Location: EU and United States, EU Standard Contractual Clauses

    Sentry

    Purpose: Error and crash monitoring

    Data processed: Technical error data, pseudonymised user identifier

    Location: EU region

    Resend

    Purpose: Transactional email delivery

    Data processed: Email address, message content of transactional emails

    Location: EU and United States, EU Standard Contractual Clauses

    OneSignal

    Purpose: Push notifications

    Data processed: Device token, notification interaction events

    Location: United States, EU Standard Contractual Clauses

    Usercentrics

    Purpose: Consent management

    Data processed: Consent records, pseudonymised identifier, timestamp

    Location: Germany

    3. Analytics & Attribution

    Firebase (Google)

    Purpose: App analytics, crash reporting

    Data processed: Usage metrics, device information

    Google Analytics for Firebase

    Purpose: Behavioral analytics

    Data processed: Session metrics, engagement data

    Attribution & Advertising Measurement Partners

    Examples may include:

    • Appsflyer
    • Adjust
    • Moloco

    Purpose: Conversion tracking, campaign measurement

    Data processed: Installation events, subscription events

    Mixpanel

    Purpose: Product analytics

    Data processed: Pseudonymised usage events, feature interactions

    Location: EU region

    4. Advertising Platforms

    Advertising platforms may include:

    • Meta (Facebook / Instagram)
    • Google Ads
    • TikTok Ads

    Purpose: Campaign delivery and conversion measurement

    Data shared: Limited conversion-level event data

    Sensitive conversational data is not shared with advertising platforms.

    5. Payment Processing

    Payments are processed exclusively through:

    • Apple App Store
    • Google Play Store

    naraa GmbH does not process or store full payment card details.

    RevenueCat

    Purpose: Subscription and entitlement management

    Data processed: Pseudonymised user identifier, purchase and subscription events

    Location: United States, EU Standard Contractual Clauses

    6. Data Protection Safeguards

    All sub-processors are subject to:

    • Contractual data protection obligations
    • Applicable data protection laws
    • International transfer safeguards where required

    7. Updates to This List

    We may update this list as service providers change or new providers are added.

    The "Last updated" date reflects the most recent revision.

    Where a new sub-processor is added, we announce the change on this page before the provider begins processing personal data, unless the change is required at short notice for security or legal reasons.