Who we work with
These are the companies that handle data for the Orliea app. Each one is bound by a data processing agreement, either signed with us or built into the terms it works under, meaning it may only handle your data on our instructions and for our purposes. Before we add a company to this list, we update this page and email every user at least 30 days ahead.
Apple and Google appear here because they sell the subscription. For payment data they are independent controllers under their own terms, not our processors.
| Company | What it does for us | What it can see | Where |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd, Singapore; hosting through Amazon Web Services) | Database, sign-in, file storage | Your account and your whole health record, encrypted at rest | Stored and processed in Ireland (Amazon Web Services' Dublin region, eu-west-1). The contract is with Supabase's Singapore company, covered by the EU Standard Contractual Clauses (Module Two). Supabase uses its own sub-contractors, such as Amazon Web Services for hosting, under our agreement with it. |
| Resend (Plus Five Five, Inc., United States) | Sends our emails: sign-in codes, service messages, and a short notice to us when a Requests box message arrives | Your email address. The notice about a Requests box message carries only its type and an id, never what you wrote, your name or your email | Resend is a US company, and the mail path we use runs through a data centre in Ireland. The transfer is covered by the EU Standard Contractual Clauses in Resend's data processing addendum; Resend states it is certified under the EU-US Data Privacy Framework |
| Apple (Apple Distribution International Ltd, Ireland) and Google (Google Commerce Ltd, Ireland) | Sell the subscription and process payment | Your purchase and payment details. They are the seller of the subscription and act as independent controllers for payment data, under their own terms and privacy policies. We only get the confirmation described in 2.3. | Their own systems |
| Expo (650 Industries, Inc., United States) | Delivers app updates | Your platform, the app version, a random per-install identifier, whether the last launch crashed, and your IP address. Never your account or your record | United States, under the EU Standard Contractual Clauses in Expo's terms; Expo states it participates in the EU-US Data Privacy Framework |
| Google Workspace (Google Cloud EMEA Limited, Ireland) | Hosts our mailbox, [email protected] | Anything you email us, including health details you choose to include, and the notices that a Requests box message arrived (type and id only) until we delete them | Google's data centres in the EU and the United States, under Google's Cloud Data Processing Addendum with the EU Standard Contractual Clauses |
| RevenueCat, Inc. (United States) | Receives subscription confirmations from Apple and Google and tells the app whether you are subscribed | A random id we assign, which store, which plan, purchase and renewal dates. Never your email, card details or health data | United States, under the EU Standard Contractual Clauses in RevenueCat's data processing addendum |
The website orliea.app uses two further services for the site itself, Cloudflare and Google Fonts, described in the website privacy notice.
Changes
- 17 October 2026, version 3: Anthropic removed. Orliea does not use AI on your data, so no AI provider receives anything.
- 16 October 2026, version 2: Resend's legal name corrected to Plus Five Five, Inc., with its US base and the transfer safeguard added; Google Workspace's contracting entity corrected to Google Cloud EMEA Limited; the Requests box notice described as it has been sent since 14 October 2026 (its type and an id only, never the text); the contract sentence reworded, because one provider's data processing terms sit inside its service terms rather than in a separate signed agreement. No company was added or removed.
- 9 October 2026, version 1: first published list.
Last updated 18 October 2026