Sub-processors
Last updated: May 23, 2026
We rely on the following sub-processors to operate Onwards Upwards. Each is bound by a data-processing agreement and processes personal data only on our documented instructions. We notify users of material changes to this list at least 30 days in advance — email privacy@onwardsupwards.app to subscribe to change notifications.
| Provider | Purpose | Data processed | Location | Transfer | Terms | Added |
|---|---|---|---|---|---|---|
| Supabase (via Lovable Cloud) | Managed Postgres database, authentication, file storage. | Account data, journal entries (Art. 9 special category), profile, auth events. | EU (Frankfurt / Ireland) — region selected by Lovable Cloud. | EU SCCs + UK IDTA where applicable. | DPA·Privacy | 2024-09-01 |
| Cloudflare, Inc. | Edge hosting, TLS termination, DDoS protection, CDN. | IP address, request metadata, encrypted traffic. | Global edge network. | EU SCCs + UK IDTA. | DPA·Privacy | 2024-09-01 |
| Lovable | Application hosting, build pipeline, AI Gateway for Insights. | Application code, deployment metadata, in-app errors, AI prompt metadata (intensity scores and tags only — no journal text). | EU / US. | EU SCCs. | DPA·Privacy | 2024-09-01 |
| Resend, Inc. | Transactional and authentication emails (sign-up confirmation, password reset). | Email address, send metadata, bounce / complaint events. | United States. | EU SCCs. | DPA·Privacy | 2024-09-01 |
| Google LLC (OAuth) | Optional Google sign-in. | OAuth identifier, email, display name (only if you use Google sign-in). | Global. | EU SCCs. | DPA·Privacy | 2024-09-01 |
How we keep this list current
- We review this list at least quarterly and on every new vendor onboarding.
- Material changes (new sub-processor, change of location, change of purpose) are announced at least 30 days in advance via email to subscribers and via the "Last updated" date above.
- You may object to a new sub-processor under GDPR Art. 28(2). If we cannot accommodate the objection you may terminate and request deletion.
- An archive of prior versions is available on request from privacy@onwardsupwards.app.
Questions? Email privacy@onwardsupwards.app.