Legal
Subprocessors
The short version: these are the infrastructure providers we rely on to run Biojrnl. Each one only processes the data needed for its function, under a data-processing agreement. We do not sell your data or share it with anyone outside this list.
Biojrnl Ltd (the data controller) uses the following third-party subprocessors. We keep this page current; see our Privacy Policy for how your data is handled overall.
| Subprocessor | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication and encrypted cloud backup & file storage. Receives any data you opt to sync to the cloud. | EU West |
| RevenueCat | Subscription & in-app purchase management. Receives the account's random identifier, purchase receipts and the device and app details attached to them. No health data, no email address. | US |
| Resend | Transactional email (sign-in links, waitlist confirmation, invitations, account notices). Receives the addresses we email and the content of those emails, including invitation sender names and invite codes. No health data. | EU / US |
| Sentry | Crash & error reports. Captured automatically when the app runs into an error, and sent to us only while "Help improve Biojrnl" is switched on in Settings, which is off unless you turn it on. Configured with PII scrubbing and no health-data capture. | EU |
| Cloudflare | Website hosting (Cloudflare Pages), DNS and content delivery. Receives standard request metadata (IP, country, user agent). Also stores the pre-launch waiting list in Workers KV: your email address, the date you signed up, the date we last saw you, and the IP address the signup came from. Stores, in a D1 database in Western Europe, the website's own visit records (not your IP address or anything you type; each deleted once added into daily totals), the daily totals made from them, and the launch offer codes with the random claim number each was given. Runs Turnstile, which checks that an offer claim comes from a person, using browser and connection signals including the IP address. | Global / EU |
| Microsoft 365 | Business email (biojrnl.com mailboxes) for support, GDPR enquiries and security correspondence. Receives only what you email us. | EU (UK tenancy) |
| Prighter | Our representative in the European Union under Article 27 GDPR (Prighter EU Rep GmbH, Vienna; representative located in Ireland). Processes the privacy requests EU residents send through its portal, including anything the requester chooses to write. Its own sub-processors, per its published terms: DigitalOcean (US) and Microsoft 365 (US), both under the EU-U.S. Data Privacy Framework, plus Hetzner Online (EEA) and Strato (Germany). | EU / US |
| Apple | iOS App Store distribution and in-app purchase billing. | Global |
| Google Play distribution and in-app purchase billing. | Global |
Where a subprocessor is located outside the UK/EEA, the transfer is protected by appropriate safeguards (such as Standard Contractual Clauses).
Changes
If we add or change a subprocessor, we'll update this page. Material changes will also be reflected in the Privacy Policy.
Contact
Questions about our subprocessors? Email gdpr@biojrnl.com.