Rhada Subprocessors Register
Version 1.0.0 · Effective 25 May 2026
This register lists every third-party company that processes personal information on DIAN Holdings Limited's behalf in the provision of the Rhada Service ("sub-processors"). It is referenced from §5.1 of the Privacy Policy.
For each sub-processor we list:
- Provider — legal entity name and country of incorporation;
- Purpose — what the provider does for us;
- Categories of personal data shared — what we send to them;
- Region of processing — where they process the data;
- Cross-border-transfer mechanism (where applicable);
- Provider's privacy policy / DPA terms — link to the provider's own publication;
- Last reviewed — when we last verified the provider's terms and posture.
We add to or remove from this register through the change-management process described in CHANGELOG.md: every change is versioned, dated, and documented in the changelog.
1. Sub-processors as of the effective date
1.1 Supabase Inc.
| Field | Detail |
|---|---|
| Legal entity | Supabase Inc. (Delaware, USA) |
| Purpose | Primary database (PostgreSQL), authentication (GoTrue), storage, edge functions, scheduled jobs |
| Personal data | All operational categories: account, profile, body composition, health metrics, food logs, coach conversations, push tokens, audit logs |
| Region | Project region selected by us at creation; the underlying compute is run on AWS / GCP. Users notified of any region migration |
| Transfer mechanism | DPA + Standard Contractual Clauses for transfers outside the EEA / UK / Switzerland; EU-US DPF where the AWS / GCP region is certified |
| Provider links | https://supabase.com/privacy · https://supabase.com/legal/dpa · https://supabase.com/legal/sub-processors |
| Last reviewed | 2026-05-25 |
1.2 Anthropic, PBC
| Field | Detail |
|---|---|
| Legal entity | Anthropic, PBC (Delaware, USA) |
| Purpose | AI coaching, weekly meal-plan generation, workout-plan generation, coach plan-update suggestions (Claude API; current model: claude-sonnet-4-6) |
| Personal data | Coach messages, recent check-in narrative, weight and food summaries needed to generate a plan, profile context |
| Region | USA |
| Transfer mechanism | Anthropic API Terms + DPA + SCCs for EEA/UK transfers; Anthropic does not use Claude API inputs to train its general models (Anthropic Commercial Terms §B.5) |
| Provider links | https://www.anthropic.com/legal/privacy · https://www.anthropic.com/legal/commercial-terms · https://www.anthropic.com/legal/dpa |
| Last reviewed | 2026-05-25 |
1.3 Google LLC (Gemini API)
| Field | Detail |
|---|---|
| Legal entity | Google LLC (Delaware, USA) |
| Purpose | AI food-photo vision and nutrition-label vision (Gemini API; current model: gemini-2.5-flash) |
| Personal data | Meal photos, nutrition-label photos |
| Region | USA (Gemini API endpoints) |
| Transfer mechanism | Google Cloud DPA + SCCs for EEA/UK transfers; Google does not use paid Gemini API inputs to train its general models per the Gemini API Additional Terms |
| Provider links | https://policies.google.com/privacy · https://cloud.google.com/terms/data-processing-addendum · https://ai.google.dev/terms |
| Last reviewed | 2026-05-25 |
1.4 Google LLC (Google Identity for federated sign-in)
| Field | Detail |
|---|---|
| Legal entity | Google LLC (Delaware, USA) |
| Purpose | Federated sign-in (Google as identity provider) |
| Personal data | OAuth ID token (email, sub, name where consented by you) |
| Region | USA |
| Transfer mechanism | Google as independent controller of the federated-auth flow; data shared with us only after your explicit sign-in. We then act as controller for the identifier we receive |
| Provider links | https://policies.google.com/privacy |
| Last reviewed | 2026-05-25 |
1.5 Apple Inc.
| Field | Detail |
|---|---|
| Legal entity | Apple Inc. (California, USA) |
| Purpose | Sign in with Apple (federated identity); Apple Push Notification service (APNs); App Store billing for iOS subscriptions; HealthKit (on-device read with your permission) |
| Personal data | Apple sub identifier (and email-relay address where you consent); APNs token; subscription state from App Store; HealthKit metrics on-device |
| Region | USA / global |
| Transfer mechanism | Apple as independent controller for the App Store and federated-identity flows; we act as controller for the identifier we receive |
| Provider links | https://www.apple.com/legal/privacy/ · https://www.apple.com/legal/internet-services/itunes/ |
| Last reviewed | 2026-05-25 |
1.6 RevenueCat, Inc.
| Field | Detail |
|---|---|
| Legal entity | RevenueCat, Inc. (California, USA) |
| Purpose | Subscription state management and webhook relay (Apple / Google billing events) |
| Personal data | User pseudonymous identifier, App Store / Play Store transaction identifier, subscription entitlement state, trial start/end dates |
| Region | USA |
| Transfer mechanism | RevenueCat DPA + SCCs |
| Provider links | https://www.revenuecat.com/privacy · https://www.revenuecat.com/dpa |
| Last reviewed | 2026-05-25 |
1.7 650 Industries, Inc. (d/b/a Expo)
| Field | Detail |
|---|---|
| Legal entity | 650 Industries, Inc. (California, USA) |
| Purpose | Push token registration and delivery via the Expo Push Service; EAS Build infrastructure (build-time only — no user data flows through EAS at runtime) |
| Personal data | Expo push token (device identifier); no other user data |
| Region | USA |
| Transfer mechanism | Expo Terms of Service + DPA |
| Provider links | https://expo.dev/privacy · https://expo.dev/terms |
| Last reviewed | 2026-05-25 |
1.8 Resend, Inc.
| Field | Detail |
|---|---|
| Legal entity | Resend, Inc. (Delaware, USA) |
| Purpose | Transactional email delivery (account confirmations, password resets, security notices) |
| Personal data | Email address, message content |
| Region | USA / EU (region pinned per environment) |
| Transfer mechanism | Resend DPA + SCCs for EEA/UK transfers |
| Provider links | https://resend.com/legal/privacy-policy · https://resend.com/legal/dpa |
| Last reviewed | 2026-05-25 |
1.9 Functional Software, Inc. (d/b/a Sentry)
| Field | Detail |
|---|---|
| Legal entity | Functional Software, Inc. (California, USA) |
| Purpose | Crash and error reporting (organisation: dian-holdings-limited, project: rhada) |
| Personal data | Anonymised crash reports, stack traces, device model, OS version, app version. PII scrubbing is enabled |
| Region | USA / EU (region selectable) |
| Transfer mechanism | Sentry DPA + SCCs for EEA/UK transfers |
| Provider links | https://sentry.io/privacy/ · https://sentry.io/legal/dpa/ |
| Last reviewed | 2026-05-25 |
1.10 OpenFoodFacts (Open Food Facts Association)
| Field | Detail |
|---|---|
| Legal entity | Open Food Facts Association (France, EU) |
| Purpose | Public barcode lookup for product nutritional data |
| Personal data | We send a barcode string only. No user identifier, no IP correlation to profile records |
| Region | EU (France) |
| Transfer mechanism | Public API — no personal data sent. Open Food Facts publishes data under ODbL |
| Provider links | https://world.openfoodfacts.org/privacy · https://world.openfoodfacts.org/terms-of-use |
| Last reviewed | 2026-05-25 |
2. Sub-processors not in use
For clarity, we explicitly confirm that we do not use any of the following categories of sub-processor for the Rhada Service:
- Advertising networks, ad SDKs, ad exchanges, or supply-side platforms (Facebook, Google Ads, AdMob, Unity Ads, AppLovin, etc.).
- Data brokers or audience-data enrichment providers (Acxiom, Experian, Oracle Data Cloud, etc.).
- Cross-app or cross-site tracking SDKs (AppsFlyer, Adjust, Branch attribution, etc.).
- Social-graph SDKs (Facebook SDK, X SDK, LinkedIn SDK).
- Voice analytics or behavioural-biometric providers.
This is a product-design decision, not a process gap. If it ever changes, we will add the provider to §1, document the change in the CHANGELOG, bump the Privacy Policy version, and re-prompt for consent.
3. Change management
We will add or remove sub-processors only through this process:
- Open a pull request to update this register and the Privacy Policy.
- Update CHANGELOG.md with the change, the date, and the rationale.
- Bump the Privacy Policy version (minor for a new sub-processor; major if it materially changes data flow).
- If users in EEA / UK / other consent-required jurisdictions are affected, re-prompt for acceptance in-app and notify by email.
4. Provider sub-sub-processors
Several of our sub-processors run on underlying cloud infrastructure (most notably Supabase on AWS / GCP). Where a sub-processor publishes its own sub-processor list, we link to it in the row above. We accept the sub-processor's onward-engagement of its own sub-processors under each provider's DPA, subject to provider notification of new sub-processors and our right to object.
5. Contact
For questions about this register, write to support@rhada.app.
End of Subprocessors Register v1.0.0.