Subprocessors
Last updated: 11 August 2026 · Effective: 11 August 2026 · Part of the Privacy Policy
1. About this list
These are every company that processes personal data on TOVELU's behalf, what each one receives, and why. This page is referenced by, and forms part of, our Privacy Policy. We publish it because you cannot meaningfully consent to something you cannot see.
Each provider acts as a processor on our documented instructions, under a data-processing agreement that includes confidentiality, security obligations, assistance with your rights requests, breach notification, and (where relevant) the EU Standard Contractual Clauses. Dodo Payments is the exception: as Merchant of Record it is an independent controller of your payment data.
2. Current subprocessors
| Provider | What it does for us | Data it receives | Where |
|---|---|---|---|
| Supabase | Database, authentication, storage | Everything in your account: identity, survey answers including health data, plan and tracker history, subscription status | EU / US, per project region |
| Vercel | Website and app hosting, CDN, DNS | Technical data in request logs: IP address, user agent, requested URL. Application data passes through in transit. | Global edge network; US-headquartered |
| Dodo Payments (Merchant of Record) | Checkout, billing, subscriptions, tax, refunds | Name, email, billing address, payment card details (handled entirely by them), transaction records | Per their terms |
| Anthropic PBC | Identifies food in a photo, on request only; and powers the Coach chat and the personalised messages on Flow, Pulse and Health | For photos: the image only, nothing else. For the Coach: a per-request snapshot — first name, goal, targets, kitchen inventory, recent check-ins, cooking constraints, allergies and plain-language health signals. Never self-harm or eating-disorder screening answers, email, password or payment data. Not used to train models. | United States |
| Brevo (Sendinblue) | Transactional and marketing email | Name, email address, message content, delivery and engagement events | European Union (France) |
| Post Affiliate Pro (Quality Unit) | Affiliate referral tracking and commissions | Referral identifier, click and sale events, order value; affiliate account details. No customer health data, no customer identity. | European Union |
| Google (Sheets / Apps Script) | Stores affiliate and partner program applications | Affiliate applicants only: name, email, country, mobile, PayPal address, social handles and application answers. No customer or health data. | United States |
| Google (Sign in with Google, optional) | Optional sign-in method | Your name, email address and Google account identifier, only if you choose it | United States |
| PayPal | Affiliate commission payouts | Affiliates only: PayPal email address and payment amount | Global |
| Google (Analytics 4, Google Ads) marketing site only | Website analytics; advertising measurement and remarketing | Pages viewed on tovelu.store, referrer, cookie identifiers, IP (anonymised). Google Signals disabled. No account, survey or health data. | United States / global |
| Microsoft (Clarity) marketing site only | Heatmaps and session replay of the marketing site | Interaction with tovelu.store pages, cookie identifiers. Text input masked. Never runs on the app or survey. | United States |
| Meta (Meta Pixel) marketing site only | Measures whether an ad led to a subscription; advertising audiences | Pages viewed on tovelu.store and subscription events, cookie identifiers. No health data, ever — and Meta's own terms prohibit sending it. | United States / global |
The last three run only on the marketing website at tovelu.store. They are blocked in code from running on app.tovelu.store, so they never touch the survey, your plan or any health record — see the Cookie Policy. They load only with your consent where consent is required, and you can withdraw it at any time through cookie settings.
We do not currently use an error-monitoring provider.
3. What we require of them
- A written data-processing agreement, with processing limited to our instructions.
- Confidentiality obligations on their staff.
- Appropriate technical and organisational security measures.
- Assistance with access, correction and deletion requests you make to us.
- Prompt notification of any personal-data breach.
- Deletion or return of data when the relationship ends.
- Standard Contractual Clauses, or another valid transfer mechanism, wherever data leaves the EEA or UK.
- No use of your data to train their own models, unless we have said so on this page. (Today, none do.)
One honest qualification. Google, Microsoft and Meta do not act as pure processors for advertising and analytics — they also use the data for their own purposes under their own terms, as independent or joint controllers. That is precisely why those three are consent-based, listed separately, confined to the marketing site, and switchable off at any moment. Dodo Payments is likewise an independent controller as Merchant of Record.
4. Notice of changes
Before we add a subprocessor that will handle your personal data, or replace one, we update this page. Where the change is material we also notify account holders by email. If you object to a new subprocessor on reasonable data-protection grounds, tell us at ask@tovelu.store — and if we cannot resolve it, you may terminate and receive a pro-rata refund of the unused part of your term.