This list is the authoritative overview of the service providers that process personal data on behalf of naraa GmbH (processors under Art. 28 GDPR). All other documents refer to this page. Before a service provider processes personal data of our users, we conclude a data processing agreement with it.
1. App
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase Inc. | Sign-in and account verification | email address or phone number, one-time codes, sign-in identifiers, pseudonymous user ID | data centre in Frankfurt; provider based in the USA | Standard Contractual Clauses |
| DigitalOcean LLC | App servers and database | all data stored in the app, e.g. account, chats, memories | data centre in Frankfurt; provider based in the USA | Standard Contractual Clauses |
| Amazon Web Services EMEA SARL (Amazon S3) | Storage of profile photos and generated images | image files, pseudonymous user ID | Luxembourg; data centre in Frankfurt | EU-US Data Privacy Framework, Standard Contractual Clauses |
| OpenAI | Persona replies, automated safety checks | messages and conversation context, prompts | contracting entity OpenAI Ireland Ltd.; processing in the USA | Standard Contractual Clauses |
| ElevenLabs | Voice calls; media transport via LiveKit (sub-processor of ElevenLabs) | real-time voice input, text of replies | USA | Standard Contractual Clauses |
| xAI (Grok) | Generation of images and videos | prompts, persona details, generated media | USA | Standard Contractual Clauses |
| Google (Firebase Cloud Messaging) | Push notifications | device token, notification content | USA | EU-US Data Privacy Framework, Standard Contractual Clauses |
| RevenueCat Inc. | Management of subscriptions and purchases | pseudonymous user ID, purchase and subscription events, transaction ID | USA | Standard Contractual Clauses |
| Resend Inc. | Sending emails, including sign-in codes | email address, email content, one-time code, delivery status | USA | EU-US Data Privacy Framework, Standard Contractual Clauses |
| Twilio Inc. | Sending sign-in codes by text message | phone number, one-time code, delivery status | USA | EU-US Data Privacy Framework, Standard Contractual Clauses |
| Functional Software Inc. (Sentry) | Error and crash reports | technical device data, error messages, masked screenshots, pseudonymous user ID | EU (Germany); provider based in the USA | EU-US Data Privacy Framework, Standard Contractual Clauses |
| Usercentrics GmbH | Consent management | consent choices with timestamp, pseudonymous consent ID, device data | Germany; processing in the EU | not required (EU) |
2. Website
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Lovable (Lovable Labs) | Website hosting | server logs | Sweden; sub-processors also in the USA | Standard Contractual Clauses |
| Supabase Inc. | Waitlist database, server functions for forms | waitlist data, contact enquiries while being forwarded | data centre in Frankfurt; provider based in the USA | Standard Contractual Clauses |
| Resend Inc. | Sending waitlist and contact form emails | email address, email content, delivery status | USA | EU-US Data Privacy Framework, Standard Contractual Clauses |
3. Independent controllers
Apple (App Store) and Google (Google Play) handle purchases and payments as independent controllers. Their privacy policies apply directly. We do not receive payment data from them.
With your consent, Meta Platforms Ireland Ltd., TikTok Technology Limited and Google Ireland Ltd. (Google Ads) receive events about installs and purchases via Adjust in order to measure ads. They are not processors; they process this data as independent controllers (see Marketing & Tracking Disclosure).
4. Analytics and advertising
We only use these services with your consent. Details are in the Marketing & Tracking Disclosure.
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Google Ireland Ltd. (Google Analytics for Firebase) | Analysis of app usage | app instance ID, usage events, device data | Ireland; also processed by Google LLC in the USA | EU-US Data Privacy Framework, Standard Contractual Clauses |
| Adjust GmbH | Measurement of advertising campaigns (attribution) | advertising ID, IP address, device data, install and purchase events | Germany (Berlin) | Standard Contractual Clauses where data is processed outside the EU |
5. Changes
Before a new processor receives data, we add it to this list, unless a change is required at short notice for security or legal reasons.