Subprocessors
Last updated: [EFFECTIVE DATE]
These are the third-party companies that process personal information on our behalf to run Immuno. Each one is bound by a written agreement limiting it to processing data on our instructions, for the purpose listed here and nothing else.
| Vendor | Role | Data it can access | Processing location |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage, and server-side functions | All account data, children's profiles, health and habit logs, game state, uploaded avatars | [SUPABASE REGION — e.g. United States / EU] |
| Vercel, Inc. | Website and application hosting and content delivery | Technical request logs: IP address, user agent, timestamps, requested paths | United States and global edge network |
| Stripe, Inc. | Payment processing, subscription billing, and fraud prevention | Parent's name, email, billing address, and payment card details. Stripe receives no information about children. | United States and Ireland |
| OpenAI, L.L.C. | Speech-to-text transcription for voice food logging (paid plans only) | The audio clip you record. Not used for model training. Not retained by us. | United States |
| Anthropic PBC | Converting a voice transcript into a structured food entry (paid plans only) | The text transcript of the food description. Not used for model training. | United States |
| Apple Inc. | Distribution of the Immuno Sync iOS app; HealthKit access on your device | HealthKit data is read on your device with your permission. Apple does not receive your Immuno data from us. | On device / United States |
| [EMAIL PROVIDER] | Transactional email — account verification, billing notices, privacy notifications | Parent's email address and the message content | [REGION] |
Data we never send to a vendor
- Children's health logs are never sent to Stripe or to any advertising, analytics, or marketing platform.
- We use no third-party advertising SDKs, no behavioral analytics vendors, and no data brokers.
Changes
If we add, replace, or remove a subprocessor that handles children's personal information, we will update this page and notify the parent on each account. Where the law requires renewed consent, we will obtain it before the change takes effect.
Questions: [PRIVACY EMAIL]