Sub-processors

Last updated: June 2026

The following third-party service providers process personal data on behalf of Inside Out Harmony e.U. ("My Within"). Where a signed Article 28 GDPR Data Processing Agreement is available it has been executed; where the provider does not offer a separate DPA we rely on their published Privacy Policy and Terms of Service. Sub-processor detail is published so that you can exercise your right to informed consent.

1. Infrastructure & hosting

• Hetzner Online GmbH - hosting of the FastAPI backend, MongoDB, encrypted disks and MongoDB dumps.
  Data centre: Helsinki, Finland (HEL1) - 100 % EU/EEA. Backup dumps go to a Hetzner Storage Box in the same region.
  Legal basis: Art. 28 GDPR AVV signed.

2. Payments

• Stripe Payments Europe, Ltd. (Dublin, IE) - web checkout, invoicing, VAT MOSS, Stripe Connect for coach payouts.
• RevenueCat, Inc. (San Francisco, US · EU-U.S. DPF) - App Store / Play Store receipt validation.

3. AI / model inference

• Emergent (Universal LLM Key) - proxies to OpenAI, Anthropic and Google models.
  Legal basis: Emergent does not currently offer a separate Article 28 DPA. Data handling is governed by Emergent's published Privacy Policy and Terms of Service (both linked here for user review).
  Mitigation: prompts are pseudonymised on our servers (Presidio + spaCy NER + coach/client-name masking) before egress; freemium users are technically blocked from AI endpoints; explicit opt-in consent is collected under GDPR Art. 9(2)(a) before the first AI analysis.

4. Observability & analytics

• Sentry EU (Frankfurt, DE) - crash / error reporting. PII scrubbed at source.
• PostHog EU (Frankfurt, DE) - anonymised product analytics. IP anonymised.

5. Push notifications & email

• Google Firebase FCM (Dublin, IE) - push notifications on iOS & Android.
• Resend - transactional email (support, receipts, GDPR request confirmations).

Not sub-processors

Apple Inc. (App Store IAP) and Google LLC (Play Store Billing) are separate controllers under the respective store terms and are not our sub-processors.

Objecting to a sub-processor

You can object to the use of a specific sub-processor by writing to privacy@my-within.com. Where legally possible we will re-route your data or offer termination of your subscription.