Sub-processors
On this page 4 sections
This list is published by WhealBit (“Splash”, “we”). It supports our Privacy Policy and How we process data.
1. What a sub-processor is
A sub-processor is a third party that processes personal data on our behalf and on our instructions to run Splash. Each is bound by a written contract with data protection obligations meeting Article 28 of the UK GDPR, and we remain responsible for them. Because your health data is encrypted on your device, none of them can read it.
2. Current sub-processors
| Sub-processor | Purpose | Personal data | Location | Safeguards |
|---|---|---|---|---|
| Supabase (Supabase, Inc.) | Database, authentication, account emails, the encrypted backup and partner-share store, scheduled push notifications | Email, password hash, sessions, display name, sync metadata, share categories and dates, push addresses, notification text and times. Health data only as ciphertext | Paris, France (EU, eu-west-3) | EU storage; UK adequacy regulations for the EEA. Supabase DPA; SCCs with UK Addendum for any access from outside the UK/EEA |
| Vercel (Vercel, Inc.) | Hosting and delivering the app files and this website | Technical request data (IP address, browser, request time). No health data | Global edge network, including the US | Vercel DPA; SCCs with UK Addendum and/or EU-US Data Privacy Framework (UK Extension) |
3. Independent recipients (not our sub-processors)
These receive limited technical data as controllers in their own right, under their own privacy notices. None receives health data.
| Recipient | When | What they receive |
|---|---|---|
| Browser push services (Apple, Google, Mozilla, Microsoft and others) | Only if you turn on notifications | Your push address and the notification message (neutral by default) |
| Google (fonts.gstatic.com, Noto emoji) | When the app shows some rarer emoji as images | Your IP address and browser details |
| Hugging Face | Only if you turn on the natural read-aloud voice: a one-off model download | Your IP address and browser details |
4. Changes to this list
We will update this page before adding or replacing a sub-processor, and tell account holders in the app. Questions or objections: hello@splash.care. If you object, you can export your data and delete your account at any time; the app keeps working without one.
Related legal documents
Questions about any of these? Email hello@splash.care.
Without an account, none of this reaches us.
Your cycle stays on your phone by default. Free, no data sales.
