Sub-processors

Last updated: June 2026

The following third-party service providers process personal data on behalf of Inside Out Harmony e.U. ("My Within") under signed Article 28 GDPR Data Processing Agreements. We publish this list so that you can exercise your right to informed consent.

1. Infrastructure & hosting

• Hetzner Online GmbH — hosting of the FastAPI backend, MongoDB, encrypted disks and MongoDB dumps.
  Data centre: Helsinki, Finland (HEL1) — 100 % EU/EEA. Backup dumps go to a Hetzner Storage Box in the same region.
  Legal basis: Art. 28 GDPR AVV signed.

2. Payments

• Stripe Payments Europe, Ltd. (Dublin, IE) — web checkout, invoicing, VAT MOSS, Stripe Connect for coach payouts.
• RevenueCat, Inc. (San Francisco, US · EU-U.S. DPF) — App Store / Play Store receipt validation.

3. AI / model inference

• Emergent (Universal LLM Key) — proxies to OpenAI (GPT-5.2), Anthropic (Claude 4.5), Google (Gemini 3).
  Prompts are pseudonymised (Presidio + spaCy NER) before egress. Zero Data Retention (ZDR) enforced.

4. Observability & analytics

• Sentry EU (Frankfurt, DE) — crash / error reporting. PII scrubbed at source.
• PostHog EU (Frankfurt, DE) — anonymised product analytics. IP anonymised.

5. Push notifications & email

• Google Firebase FCM (Dublin, IE) — push notifications on iOS & Android.
• Resend — transactional email (support, receipts, GDPR request confirmations).

Not sub-processors

Apple Inc. (App Store IAP) and Google LLC (Play Store Billing) are separate controllers under the respective store terms and are not our sub-processors.

Objecting to a sub-processor

You can object to the use of a specific sub-processor by writing to privacy@my-within.com. Where legally possible we will re-route your data or offer termination of your subscription.