Sub-processors
Last updated: 30 July 2026.
The service providers below help us run MySymplyApp. We keep the list short on purpose, vet each provider for security and data protection, and publish it here so you can audit it at any time.
| Provider | Status | Purpose | Region | Data | Transfers outside the EEA | Retention |
|---|---|---|---|---|---|---|
| Cloudflare, Inc. | Active | Web serving, edge compute (server-side rendering), CDN, DDoS mitigation | Global edge (EU-first routing) | Request metadata, IP addresses, TLS termination | Cloudflare data processing addendum with standard contractual clauses | Edge request logs per Cloudflare's own defaults |
| Supabase (Supabase Inc.) | Active | Database, authentication, object storage, and transactional email delivery via Supabase's built-in mail provider (sign-in confirmations, share notifications) | European Union (Ireland) | All application data at rest — profiles, health records, files; email address and message body for transactional emails | Stored in the EU. Support and operational access may take place from outside the EEA under standard contractual clauses | Deleted on your instruction. Copies may remain in platform backups until the backup window rolls over |
| Lovable AI Gateway | Active | Routes document analysis requests when you opt in to MySymplyApp Scan. It is not used for voice transcription. Voice transcription runs on your own device and does not reach the gateway. The gateway only receives a document when you enable document analysis and ask for that document to be read. | European Union / United States | Health documents you choose to analyse. No voice audio. | Standard contractual clauses via the provider's terms | Passed through for processing; no storage of your documents by the gateway |
| OpenAI, L.L.C. (via Lovable AI Gateway) | Active | A reading model (gpt-5.6) used for MySymplyApp Scan document analysis. It is not used for voice transcription. | United States | Health documents you choose to analyse. No voice audio. Not used to train models. | Standard contractual clauses under the provider's API data processing terms | API content is not used to train models; provider retention per its API policy |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Active | Subscription checkout, billing, invoices, the customer portal and payment-failure handling | Ireland (European Union), with access from the United States | Email address, subscription and customer identifiers, billing country, currency and amount. Your name, address and card details are collected by Stripe directly and never reach MySymplyApp. No health information is sent to Stripe. | Stripe's data processing agreement incorporating standard contractual clauses | Billing records retained by Stripe under its terms and applicable tax law |
| Sentry (Functional Software, Inc.) | Optional / not enabled | Error monitoring; only enabled when a Sentry DSN is configured Not currently enabled in production. We will update this page before turning it on. | European Union | Error stack traces and request URLs, scrubbed of health content | Sentry's data processing agreement with standard contractual clauses | Not applicable while the integration is switched off |
Active means we are currently sending data to that provider in the production deployment. Optional / not enabled means the integration exists in the codebase but is switched off by default; we will update this page before turning it on.
We will give reasonable prior notice — through this page and in-app notice for signed-in users — before adding a new sub-processor that will process personal data.
What we do not use
MySymplyApp uses no advertising networks, no behavioural or product analytics, no third-party trackers and no cross-site cookies. We do not operate a marketing mailing list.
A note on “EU-only”
Your records are stored in the European Union. We do not claim that MySymplyApp is “EU-only”, because two things can happen outside the EEA: a document you choose to have read by MySymplyApp Scan is processed by an AI provider in the United States, and some providers’ support teams may access systems from outside the EEA under standard contractual clauses. Voice transcription is not one of them — it runs on your own device. If you would rather nothing left the EU, you can leave document analysis switched off.