Fitlyze (Beta) Version: 2.0 Effective date (last updated): July 7, 2026 Last reviewed: July 7, 2026
This page lists every third-party provider that processes personal data on behalf of DerMo Technologies Inc. (d/b/a Fitlyze) ("Fitlyze", "we", "us", "our"), and the sign-in providers that act as independent controllers. It supplements Section 8 of our Privacy Policy.
We do not sell your personal information, and no provider on this list may use your data for its own purposes. Each processor is bound by a data processing agreement limiting it to providing services to us.
Onward sub-processors. Some providers listed below rely on their own vetted sub-processors — for example, underlying cloud infrastructure (such as AWS or Google Cloud) — to deliver their service. Where they do, they remain responsible to us for that data and must impose data-protection obligations equivalent to those in our agreement, flowed down through their own data processing agreement.
1. Processors (act only on our instructions)
| Provider | What it does for you | Personal data involved | Location | Safeguards |
|---|---|---|---|---|
| Anthropic | Powers the AI assistant — chat responses, analysis of meal and nutrition-label photos, voice transcription | Your AI messages, attached photos, voice input, and relevant profile context (includes health and fitness data) | United States | Data processing agreement with Standard Contractual Clauses (+ Swiss addendum); does not train AI models on your data; retains data only briefly for safety purposes |
| LangSmith (LangChain, Inc.) | AI observability — records traces of your AI assistant interactions so we can debug problems and monitor quality and safety | Your AI messages and the assistant's responses, and the profile context sent with them (includes health and fitness data such as weight, food logs, and workout plans) | European Union (Netherlands) | Data processing agreement; data hosted in LangSmith's EU region; does not train AI models on your data; traces retained only for a limited period. LangChain, Inc. is a US-parent company — where its US entity could access the data, Standard Contractual Clauses apply |
| Tavily (AlphaAI Technologies Inc.) | Web search for the AI assistant — when the assistant needs current information from the web to answer you, it sends a search query and receives search results | Search queries generated from your AI conversation (which may reflect health or fitness details in your request). Your name, email, account identifiers, and profile data are never sent | United States | Data processing agreement with Standard Contractual Clauses; queries carry no account identifiers; does not use our search queries to train AI models |
| DigitalOcean | Hosts everything — servers, database, load balancer, and private storage for your uploaded images | All service data | Toronto, Canada | Data processing agreement; images stored privately, served via expiring signed links; Canada is recognized as adequate by the EU and Switzerland |
| PostHog | Product analytics — only if you opt in, and only after you sign in | Device/browser type, screens viewed, interactions | Frankfurt, European Union | Data processing agreement; EU-region hosting; runs only with your consent; off switch in your Profile. PostHog, Inc. is a US-parent company — where its US entity could access the data, Standard Contractual Clauses apply |
| Brevo (Sendinblue) | Sends our email — account/security messages and, only if you opt in, marketing | Your email address and name. Never your health data | European Union (Belgium) | Data processing agreement; EU-based provider subject to the GDPR; one-click unsubscribe in every marketing email |
2. Independent controllers (optional sign-in)
If you choose to sign in with them, these companies process your sign-in under their own privacy policies:
| Provider | What it does | Personal data involved | Location |
|---|---|---|---|
| Sign in with Google | Your email address and Google account identifier | United States & other regions | |
| Apple | Sign in with Apple | Your name and email address (or a private relay address if you use Hide My Email) | United States & other regions |
3. Changes to this list
Before adding or replacing a processor that handles your personal data, we will update this list and give notice of material changes by in-app notice or email, as described in our Privacy Policy. Questions: privacy@fitlyze.app.
Fitlyze — Sub-processor & Service Provider List, version 2.0, effective July 7, 2026. © DerMo Technologies Inc.