Subprocessors
Last updated: 24 September 2026
Kounisou LLC ("Kounisou") uses the third-party providers listed below to operate the Service. Each provider acts as a subprocessor of personal data as described. Each processes personal data only to provide its service to us, under its data processing terms.
We update this list when we add or remove a subprocessor. Material additions (those that process health data or expand data categories) will be communicated via email to active subscribers with at least 10 days' notice.
Infrastructure and Hosting
| Provider | Purpose | Data Processed | Location | Privacy / DPA |
|---|---|---|---|---|
| Supabase | PostgreSQL database, user authentication, file storage (exports, progress photos, voice messages) | All personal data including health data | US East (AWS us-east-1) | supabase.com/privacy · supabase.com/dpa |
| Vercel | Web hosting, serverless functions, edge routing | Request/response data, environment variables | US (multiple regions, edge network global) | vercel.com/legal/privacy-policy · vercel.com/legal/dpa |
| Cloudflare Turnstile | Bot and spam detection on sign-up and public forms | IP address, browser fingerprint signals | Global CDN | cloudflare.com/privacypolicy |
Payments
| Provider | Purpose | Data Processed | Location | Privacy / DPA |
|---|---|---|---|---|
| Stripe | Coach subscription billing (Stripe Billing); optional coach-client payment processing (Stripe Connect — direct charges) | Coach billing data, payment method tokens, transaction records, Connect account data | US | stripe.com/privacy · stripe.com/legal/dpa |
AI and Machine Learning
| Provider | Purpose | Data Processed | Location | Notes |
|---|---|---|---|---|
| OpenRouter | AI model routing — routes API requests to downstream AI providers | Prompt content (may include health data, fitness data, nutrition data as relevant to request) | US | openrouter.ai/privacy |
| Anthropic | AI model inference — Claude models power workout plan generation, meal plan generation, food-photo analysis, check-in drafts, weekly reports, client chat assistant | Prompt and response content (same data as above, routed through OpenRouter) | US | anthropic.com/privacy |
Note: Under Anthropic's commercial terms, API inputs and outputs are not used to train its models by default. We do not use your data to train AI models.
Communications
| Provider | Purpose | Data Processed | Location | Privacy / DPA |
|---|---|---|---|---|
| Resend | Transactional email delivery (account verification, password reset, check-in reminders, booking confirmations, data export links) | Email address, name, email content | US | resend.com/privacy |
| Google Workspace | Company email for Kounisou's own operations (admin@kounisou.com) | Email content for support and legal correspondence | US | workspace.google.com/terms/dpa_terms.html |
Video and Real-Time Communication
| Provider | Purpose | Data Processed | Location | Privacy / DPA |
|---|---|---|---|---|
| Daily.co | Video coaching sessions between coaches and clients | Session IDs, room metadata, duration; video/audio streams processed peer-to-peer or via Daily's media servers | US | daily.co/privacy |
Analytics and Monitoring
| Provider | Purpose | Data Processed | Location | Consent Required |
|---|---|---|---|---|
| PostHog | Product analytics | Named product events and anonymised page views, IP address, device/browser data — only with consent. Receives no health data. | US (PostHog Cloud US) | Yes — analytics cookies; users may opt out via cookie banner |
| Sentry | Application error monitoring and performance tracing | Error stack traces, request context, IP address, session identifiers. Configured without session recordings. | US | No (legitimate interest for platform security) |
Mobile Push Notifications (Planned)
| Provider | Purpose | Data Processed | Location | Status |
|---|---|---|---|---|
| Firebase Cloud Messaging (Google) | Push notifications to the iOS and Android mobile apps | Device registration tokens, notification payload (user ID, notification type) | US | Planned — not yet live |
Wearable and Health Platform Integrations
These providers are accessed at the user's explicit request and consent. Kounisou receives data from them; it does not send personal data to them (except OAuth tokens).
| Provider | Data Imported | User Consent Mechanism |
|---|---|---|
| Fitbit (Google) | Heart rate, HRV, sleep, SpO2, steps, activity | OAuth 2.0 — user authorises in-app; revocable |
| Oura | HRV, sleep, readiness, SpO2, activity | OAuth 2.0 — user authorises in-app; revocable |
| WHOOP | HRV, sleep, recovery, strain, activity | OAuth 2.0 — user authorises in-app; revocable |
| Strava | Activity type, GPS routes, duration, heart rate, distance | OAuth 2.0 — user authorises in-app; revocable |
| Garmin | Heart rate, HRV, sleep, GPS, activity, body battery | OAuth 1.0a — user authorises in-app; revocable |
| Apple Health (HealthKit) | All categories user grants (iOS privacy panel) | iOS permission prompt per category; revocable in iOS Settings |
| Google Health Connect | All categories user grants (Android permissions) | Android permission prompt per category; revocable in Android Settings |
Questions about our subprocessors or data processing agreements: email admin@kounisou.com with subject "Subprocessor Inquiry."