Sub-processors
Last updated: May 28, 2026
This page lists the third-party sub-processors that process personal data on behalf of She Affirms in connection with our App. It is published in fulfilment of GDPR Art. 28(2) and (4), LGPD Art. 39, and equivalent obligations under the EU-US Data Privacy Framework (DPF) and other international transfer instruments.
| Sub-processor | Purpose | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|
| Apple Inc. | App distribution; subscription billing; push notification delivery | Apple ID (not directly visible to us), purchase receipts, device tokens | United States | EU-US Data Privacy Framework (DPF) |
| Supabase Inc. | Backend: Auth, Postgres, Storage, Edge Functions | Anonymous user ID, wish text, generated images and audio, personal context, moderation flags | EU (Frankfurt, eu-central-1) | EU hosting; US parent under SCCs 2021/914 + Supabase DPA |
| RevenueCat Inc. | Subscription management and entitlement checks | Anonymous App User ID, purchase events, subscription status | United States | SCCs 2021/914 + RevenueCat DPA |
| Google LLC (Vertex AI / Gemini API) | Text generation (Gemini 3 Flash) and image generation (Nano Banana Pro) | Wish text, prompt, generation parameters | United States (multi-region) | EU-US DPF + Google Cloud Paid Tier (no training) |
| ElevenLabs Inc. | Audio synthesis (whispered narration) | Affirmation script text, voice parameters | United States | SCCs 2021/914 + ElevenLabs Zero Retention Mode |
| Functional Software, Inc. (Sentry) | Crash and error reporting | Device model, OS version, stack traces, anonymous user ID | United States (EU region available) | SCCs 2021/914; 90-day retention |
| PostHog Inc. | Product analytics (consent-gated) | Anonymous user ID, event names, screen views | EU region (eu.posthog.com) | EU hosting + PostHog DPA |
| OpenAI, L.L.C. | Voice transcription (Whisper API) | Voice recording (not retained), transcript text | United States | SCCs 2021/914 + Zero Data Retention |
Notice of new sub-processors
We will update this page whenever we add or replace a sub-processor. Continued use of the App after publication of the updated list constitutes acceptance of the change, unless you object by emailing contact@sheaffirms.app within 30 days of the change. If you object on reasonable data-protection grounds and we cannot offer a workaround, you may terminate use of the App and request deletion of your data.