Third-Party Sharing & Sub-processor List (Overseas)
Not submittable yet. The formal list may name only real, production-enabled processors with their actual received fields. Candidates marked "to be frozen" are not recipients of user data and must be replaced by real entities, official links and privacy-policy links, or removed, before release. We do not sell personal data.
- We engage sub-processors only where strictly necessary (cloud infrastructure, model inference, store payments, crash monitoring, support), each bound by a data-processing agreement (GDPR Art. 28) with purpose, scope, duration, security and audit constraints.
- We assess each sub-processor's security, privacy policy and compliance before engagement, and we notify you of changes where law requires.
- We do not allow sub-processors to train on your intimate content, voice, images, transcripts, long-term understanding or AI output unless you separately consent and the contract permits withdrawal and deletion.
- Fully on-device processing (e.g. on-device speech) that does not leave your device is not a transfer or a third-party sharing.
- Where structured cues or emotion candidates pass to an external model API, this list names the real processor, fields, purpose, retention, region and your opt-out.
1. Sub-processor categories (overseas)
| Category | Personal data involved | Purpose | When | Entity (to be frozen) | Mode | Status |
|---|---|---|---|---|---|---|
| Account / sign-in | Email, Apple/Google account identifiers (via Sign in with Apple / Google) | Register, sign in, recover, security | You choose email/Apple/Google sign-in | Apple Inc. / Google LLC (OIDC/SIWA) | Authorised API | To be frozen |
| Model inference | Minimum text / transcript / media fragments assembled by Context Capsule; authorised voice cues | Echo organisation, Talk-It-Through, transcription analysis, image/video understanding, safety recognition, generation | You actively use AI features | AWS Bedrock / Azure AI Foundry (geo-locked region) | Processor (Art. 28), ProviderAdapter-scoped | To be frozen |
| Cloud infrastructure | Account id, encrypted records, media objects, access/system logs, backups, audit | Database, object storage, key management, compute, queues, monitoring, security | Runtime and your save/read/delete/export | AWS / Azure / GCP region entity | Processor (Art. 28) | To be frozen |
| Payments (post-launch) | Order id, store channel, amount, status, refund state | Subscription/purchase/refund via the app stores | You purchase (not present at launch) | Apple App Store / Google Play Billing (+ RevenueCat candidate) | Store payment; independent controller for payment data | Post-launch; to be frozen |
| Crash & performance | Device model, OS/app version, crash logs, performance, network, error type | Stability and security | Crash / anomaly | To be confirmed from real SDK scan | SDK / log API | To be frozen |
| Support / complaints | Contact, account id, description, attachments, ticket id, handling record | Feedback, complaints, appeals, safety escalation (DSA) | You submit help/complaint/appeal | Self-hosted or third-party ticketing (to be confirmed) | Processor | To be frozen |
| Email delivery (OTP / receipts) | Email address, delivery status | One-time codes, export/delete receipts, necessary notices | You request a code / receipt | SES / Resend / equivalent (to be confirmed) | Processor | To be frozen |
2. International transfers
Where a sub-processor handles data outside your region, we rely on an adequacy decision, standard contractual clauses (EU/UK) or equivalent safeguards, and we publish the recipient and safeguards. We do not transfer intimate interaction data across borders by default before safeguards are in place.
3. Placeholder rules before release
- "To be frozen / to be confirmed / candidate" must be replaced by real entity names, official links and privacy-policy links, or the row removed.
- Model providers must match the real ProviderAdapter production configuration, contracts and any transparency filing.
- The SDK list must come from the real mobile build, dependencies, packaging and store privacy checks, not from assumption.
- Cross-border, joint-controller, independent-controller or training uses are separately disclosed with required consent.