Pursuant to GDPR Article 28(2) and applicable data privacy regulations, MindActions engages the following third-party data processors to deliver core platform services, hosting infrastructure, payment processing, and application functionality:
| Subprocessor | Purpose / Activity | Corporate Location | Data Transferred / Safeguards |
|---|---|---|---|
| Render Services Inc. | Backend API Hosting | USA | System API traffic logs, encrypted payloads in transit. |
| Neon Inc. | Managed PostgreSQL Database | USA | Encrypted account metadata, Fernet-encrypted logs & chat threads. |
| Vercel Inc. | Web Application Frontend Hosting | USA | Transient web app traffic, static asset serving. |
| Google LLC (Gemini API) | AI Search, CBT Analysis, AI Coach & TTS | USA | PII-scrubbed text, Base64 voice audio for transcription/TTS. |
| Google LLC (OAuth & Calendar) | Account Sign-In & Optional Calendar Sync | USA | Email verification, OAuth tokens, voluntary calendar events. |
| Spotify AB | Music & Playlist Search Integration | Sweden / USA | OAuth tokens, audio control requests (optional feature). |
| Paddle Payments Ltd | Merchant of Record / Billing | UK / USA | Payment processing, transaction IDs, subscription tier status. |
| Google LLC (AdMob) | Rewarded Mobile Theme Ads | USA | Mobile ad interaction counters (Android client). |
| AppLixir Inc. | Rewarded WebApp Theme Ads | USA | WebApp ad interaction counters (WebApp client). |
| Cloudflare, Inc. | Website Analytics & CDN (Marketing Site Only) | USA | Anonymous aggregate web traffic metrics. No cookies or PII collected. Not present inside Android/Web App. |