Legal · GDPR Art. 28(2)

Sub-processors

Last updated: July 13, 2026. Every third party that touches your data, why they do, and the contract that binds them.

Available in 8 languages via the language switcher (top-right). The English version is authoritative.

Change notice: We commit to publishing any change to this list at least 30 days before granting a new sub-processor access to your data. Subscribe to updates by emailing hello@getkyrovo.com with subject "Sub-processor updates".

Supabase

Managed Postgres database, authentication, encrypted storage

Jurisdiction: EU (Ireland) primary; US backup
Data accessed: All user account data (email, hashed password, check-ins, scores, plans)
Safeguards: SOC 2 Type 2, ISO 27001, EU SCCs 2021/914, UK IDTA, encryption at rest (AES-256) and in transit (TLS 1.3)

Data Processing Agreement →

Stripe

Payment processing, subscription billing, tax computation

Jurisdiction: United States (independent controller for fraud/AML)
Data accessed: Email, name, billing address, card details (PCI vault only), subscription tier
Safeguards: PCI-DSS Level 1, SOC 1/2 Type 2, ISO 27001, EU SCCs, UK IDTA, DPF-certified

Data Processing Agreement →

Cloudflare

Edge CDN, DDoS mitigation, WAF, DNS

Jurisdiction: Global edge network
Data accessed: IP address, user-agent, request path, TLS metadata
Safeguards: SOC 2 Type 2, ISO 27001/27018/27701, EU SCCs, DPF-certified, 30-day edge log retention

Data Processing Agreement →

Lovable AI Gateway

LLM inference for the 90-day plan draft

Jurisdiction: Routed through EU inference endpoints where available
Data accessed: Numeric scores + task categories only. No name, email, employer, or free-text
Safeguards: Contractual no-training clause, no long-term retention, in-transit encryption

Data Processing Agreement →

Resend (transactional email)

Send transactional & opt-in reminder emails

Jurisdiction: United States / EU relay
Data accessed: Email, first name, message contents
Safeguards: SOC 2 Type 2, EU SCCs, DKIM/SPF/DMARC, 30-day content retention

Data Processing Agreement →