Sub-processors
- Version
- 2026-10-01
- Effective date
- Last updated
About this list
To run spareachair we use a small number of service providers (“sub-processors”) that process personal data on our behalf, under a data processing agreement and only on our instructions. This page lists them. For how we use personal data overall, see the Privacy Policy.
Our own media server (for live voice and video) runs on our DigitalOcean infrastructure; audio and video are never recorded or stored.
Our servers send push notifications directly to Apple (iPhone) and Google Firebase Cloud Messaging (Android). Apple receives them as an independent recipient under its own terms, so it is not listed as a sub-processor; Google is listed below.
The app and service
| Provider | Purpose | Personal data | Location | Safeguards |
|---|---|---|---|---|
| DigitalOcean, LLC | Cloud hosting: servers, managed database and cache, file storage (e.g. data exports), backups, and hosting of this website | All app data we hold (account, profile, messages, reports, logs) | EU data centre (Frankfurt, Germany); company established in the USA | Data processing agreement (Art. 28 GDPR); EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for any transfer outside the EU/EEA |
| Resend | Sending transactional email (sign-up verification, reminders, report acknowledgements, statements of reasons) | Email address, name you gave us, email content | Company established in the USA; sending region to be confirmed | Data processing agreement (Art. 28 GDPR); EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for any transfer outside the EU/EEA |
| Didit | Identity and age verification (ID document check and selfie / liveness match) at sign-up | ID document images and data, selfie and biometric template (processed by Didit only); we receive only the result | EU (to be confirmed against the DPA) | Data processing agreement (Art. 28 GDPR); explicit consent (Art. 9 GDPR) |
| Sentry (Functional Software, Inc.) | Error and crash monitoring for the app and backend | Technical data (device and app version, error traces, pseudonymous user ID) | EU data region (to be confirmed); company established in the USA | Data processing agreement (Art. 28 GDPR); EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for any transfer outside the EU/EEA |
| Expo (650 Industries, Inc.) | Over-the-air app updates (the app downloads updates from Expo’s servers) | IP address, device type, operating system and app version when the app checks for updates | USA | Data processing agreement (Art. 28 GDPR); EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for any transfer outside the EU/EEA |
| Google (Firebase Cloud Messaging) | Delivering push notifications to Android devices | Push token and notification content (for example a Connection’s display name — never the message text) | Company established in the USA | Firebase Data Processing and Security Terms (Art. 28 GDPR); EU–US Data Privacy Framework where the provider is certified, otherwise EU Standard Contractual Clauses |
| Anthropic PBC (Claude) | Automated safety screening of messages and profile texts (bio), alongside our own rules | Text only — of table messages, bios and, only with both people’s consent to direct-message screening, direct messages; never user IDs, names or other account details | USA | Data processing agreement (Art. 28 GDPR); EU–US Data Privacy Framework where the provider is certified, otherwise EU Standard Contractual Clauses; not used to train AI models; kept by the provider only for a limited period under its terms |
The website
These providers are only used on spareachair.com, and only if you accept the relevant cookies. See the Cookie Policy.
| Provider | Purpose | Personal data | Location | Safeguards |
|---|---|---|---|---|
| Google (Google Analytics 4, Google Ads) | Website analytics and ad measurement — only if you accept analytics/marketing cookies | Cookie identifiers, pages visited, device and browser data, approximate location | Google Ireland Ltd (EU) / Google LLC (USA) | Only after consent (Consent Mode v2); Data processing agreement (Art. 28 GDPR); EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for any transfer outside the EU/EEA |
| Meta (Meta Pixel) | Ad measurement for our campaigns — only if you accept marketing cookies | Cookie identifiers, pages visited, device and browser data | Meta Platforms Ireland Ltd (EU) / Meta Platforms, Inc. (USA) | Only after consent; Data processing agreement (Art. 28 GDPR); EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for any transfer outside the EU/EEA |
Changes
When we add or replace a sub-processor, we update this page, its version number and its effective date. If a change materially affects how your data is handled, we will also update the Privacy Policy and tell you.
Contact
Questions about our sub-processors: privacy@spareachair.com.