Fitlyze (Beta) Version: 3.0 Published: August 10, 2026 Effective date: August 10, 2026 Last reviewed: August 10, 2026 Supersedes: version 2.0 (July 7, 2026)
This page lists every third-party provider that processes personal data on behalf of DerMo Technologies Inc. (d/b/a Fitlyze) ("Fitlyze", "we", "us", "our"), plus the merchant of record that sells our subscriptions and the sign-in providers — both of which act as independent controllers. It supplements Section 8 of our Privacy Policy.
We do not sell your personal information, and no provider on this list may use your data for its own purposes. Each processor is bound by a data processing agreement limiting it to providing services to us.
Onward sub-processors. Some providers listed below rely on their own vetted sub-processors — for example, underlying cloud infrastructure (such as AWS or Google Cloud) — to deliver their service. Where they do, they remain responsible to us for that data and must impose data-protection obligations equivalent to those in our agreement, flowed down through their own data processing agreement.
1. Processors (act only on our instructions)
| Provider | What it does for you | Personal data involved | Location | Safeguards |
|---|---|---|---|---|
| Anthropic | Powers the AI assistant — chat responses, analysis of meal and nutrition-label photos, voice transcription | Your AI messages, attached photos, voice input, and relevant profile context (includes health and fitness data) | United States | Data processing agreement with Standard Contractual Clauses (+ Swiss addendum); does not train AI models on your data; retains data only briefly for safety purposes |
| LangSmith (LangChain, Inc.) | AI observability — records traces of your AI assistant interactions so we can debug problems and monitor quality and safety | Your AI messages and the assistant's responses, and the profile context sent with them (includes health and fitness data such as weight, food logs, and workout plans) | European Union (Netherlands) | Data processing agreement; data hosted in LangSmith's EU region; does not train AI models on your data; traces retained only for a limited period. LangChain, Inc. is a US-parent company — where its US entity could access the data, Standard Contractual Clauses apply |
| Tavily (AlphaAI Technologies Inc.) | Web search for the AI assistant — when the assistant needs current information from the web to answer you, it sends a search query and receives search results | Search queries generated from your AI conversation (which may reflect health or fitness details in your request). Your name, email, account identifiers, and profile data are never sent | United States | Data processing agreement with Standard Contractual Clauses; queries carry no account identifiers; does not use our search queries to train AI models |
| DigitalOcean | Hosts everything — servers, database, load balancer, and private storage for your uploaded images | All service data | Toronto, Canada | Data processing agreement; images stored privately, served via expiring signed links; Canada is recognized as adequate by the EU and Switzerland |
| PostHog | Product analytics — only if you opt in, and only after you sign in | Device/browser type, screens viewed, interactions | Frankfurt, European Union | Data processing agreement; EU-region hosting; runs only with your consent; off switch in your Profile. PostHog, Inc. is a US-parent company — where its US entity could access the data, Standard Contractual Clauses apply |
| Brevo (Sendinblue) | Sends our email — account/security messages and, only if you opt in, marketing | Your email address and name. Never your health data | European Union (Belgium) | Data processing agreement; EU-based provider subject to the GDPR; one-click unsubscribe in every marketing email |
2. Merchant of record and payment provider (independent controller)
Fitlyze is a paid beta. Your subscription is sold to you by our merchant of record, which is the seller of record for the transaction and handles payment, tax, invoicing, and refunds. It acts as an independent controller for those purposes under its own privacy policy — not as a processor acting on our instructions — so it is listed separately from Section 1.
| Provider | What it does for you | Personal data involved | Location | Safeguards |
|---|---|---|---|---|
| Stripe (merchant of record) | Sells and processes your subscription — takes payment, calculates and remits sales tax/VAT/GST-HST/QST, issues your receipt or invoice, manages renewals, refunds, and payment disputes, and screens payments for fraud | Your name, email address, billing address and country, card details collected directly by Stripe, subscription plan and status, transaction and refund history, and technical/device signals used for payment fraud detection. Never your health or fitness data, AI conversations, or uploaded images | United States (contracting and processing may involve Stripe's EU/Irish affiliate for EU customers — the entity is identified at checkout and on your receipt) | PCI DSS Level 1 certified; Fitlyze never receives or stores your full card number, security code, or bank credentials; Standard Contractual Clauses (+ Swiss addendum) in Stripe's data protection terms; EU–US / Swiss–US Data Privacy Framework where certification is current; does not receive health data; does not use your data to train AI models |
What this means for you. Because the merchant of record is the seller, its terms of sale and privacy policy govern the payment transaction itself, and it keeps its own transaction and tax records under its own retention rules. Your rights in relation to the Fitlyze Service — and everything in this list's Section 1 — remain against Fitlyze. See Terms of Service Section 5 and Privacy Policy Sections 2, 3, 8, 9, and 10.
3. Independent controllers (optional sign-in)
If you choose to sign in with them, these companies process your sign-in under their own privacy policies:
| Provider | What it does | Personal data involved | Location |
|---|---|---|---|
| Sign in with Google | Your email address and Google account identifier | United States & other regions | |
| Apple | Sign in with Apple | Your name and email address (or a private relay address if you use Hide My Email) | United States & other regions |
4. Changes to this list
Before adding or replacing a processor that handles your personal data — or changing our merchant of record — we will update this list and give notice of material changes by in-app notice or email, as described in our Privacy Policy. Questions: privacy@fitlyze.app.
Fitlyze — Sub-processor & Service Provider List, version 3.0, effective August 10, 2026. © DerMo Technologies Inc.