GDPR Art. 28
Subprocessors.
The third parties we rely on to operate our Service and website. Each one processes a narrow slice of personal data on our behalf, under a signed Data Processing Agreement.
Last review: 2026-05-30
01
Active subprocessors
| Provider | Purpose | Data | Region | Legal |
|---|---|---|---|---|
| Vercel Inc. | Static hosting, edge caching, request routing for natura.inc | IP address, request metadata, basic logs | USA / EU edge nodes | DPA + SCCs (EU → US), GDPR-compliant |
| Resend (Resend Inc.) | Transactional email delivery (signup confirmation) and team notifications | Email address, IP address (delivery logs), email content | USA | DPA + SCCs (EU → US) |
| Cloudflare, Inc. | Backend infrastructure, edge compute, and media storage (voice notes) | Account identifier, conversation media, request metadata | USA / global edge | DPA + SCCs (EU → US) |
| Supabase, Inc. | Primary database storing account data, conversation history, and opt-in health/location data | Account identifier, conversation transcripts, voice-note references, opt-in health and location data | EU (Frankfurt) | DPA + SCCs |
| ElevenLabs, Inc. | Real-time voice processing (speech-to-text, response, text-to-speech); zero-retention mode | Real-time voice audio, conversation text, account identifier | USA | DPA + SCCs (EU → US) |
| Composio | Authentication and account linking | Account identifier (credentials handled within Composio) | USA | DPA + SCCs (EU → US) |
| Expo (650 Industries, Inc.) | Push notification delivery (forwarded to Apple APNs / Google FCM) | Push notification token, device token | USA | DPA + SCCs (EU → US) |
| Twilio Inc. | Voice / telephony connection for voice calls | Phone number, call metadata | USA | DPA + SCCs (EU → US) |
| Google LLC | Gmail / Calendar APIs, accessed only if you connect the integration (opt-in) | OAuth tokens, requested Gmail / Calendar data | USA / EU | DPA + SCCs (EU → US) |
| AI model providers | Large language model inference to generate Agent responses (specific providers not named for security reasons) | Conversation text | USA | DPA + SCCs (EU → US) |
02
Change notification
We notify you of material changes to this list at least 30 days in advance through:
- An update to this page with a new last-review date.
- An email to subscribers, where the change affects how their data is processed.
03
Object to a subprocessor
You may object to the use of a specific subprocessor at any time by writing to ops@natura.inc. If we cannot reasonably accommodate the objection, you have the right to terminate any service that depends on that subprocessor.
04
Related
- Privacy policy — the legal basis and rights framework.
- Cookie policy — client-side storage we set ourselves.
- Submit a data subject request (access, deletion, portability).