LyoLog processors
Version 1.3 · In force from 29 October 2026 Published at lyolog.app/subprocessors
These are the providers that process personal data on our behalf. Each acts as a processor under a contract meeting Article 28 GDPR and may only process your data on our instructions. What data we process, why, and for how long is set out in the privacy policy.
Some cases fall outside our instructions and are listed separately at the foot of this page: Microsoft, for Clarity; Cloudflare’s own use of Turnstile signals to improve bot detection; and Apple and Google, when you sign in with them or buy in their store.
We keep this list on its own page so that it can be updated when a provider changes. Each update is published as a new version of this page, with its number and date.
| Provider | Function | Where processing takes place | Safeguard for transfers outside the EEA |
|---|---|---|---|
| Supabase | Database, authentication, photo storage, server functions | AWS eu-central-1 (Frankfurt, Germany) — European Union | None needed: processing stays in the European Union |
| Resend | Delivery of transactional email: account verification, password reset, invitations, and communications about reports of shared recipes. Our emails are sent from no-reply@mail.lyolog.app | Sent from Ireland (eu-west-1); message content and delivery logs are stored in the United States | Standard contractual clauses approved by the European Commission, incorporated into its data processing addendum, together with supplementary measures |
| Google Ireland Limited | The corporate email we answer you from; Google Analytics on the website, only if you accept analytics cookies | Ireland, with transfers to the United States | A European Commission adequacy decision and/or standard contractual clauses, together with supplementary measures |
| RevenueCat | Management of paid access entitlements, when you activate a subscription | United States | Standard contractual clauses approved by the European Commission, incorporated into its data processing addendum, together with supplementary measures |
| Cloudflare | DNS, content delivery and hosting of the website; tag management for website analytics (Zaraz); visit counting without cookies (Web Analytics); the iPhone waiting list; the register of reports of shared recipes; bot protection on the website’s forms (Turnstile); delivery to our own mailbox of a notice of each feedback message and of each report (Email Service) | Global; the waiting list and the register of reports are stored in the European Union | Standard contractual clauses, together with supplementary measures |
You can ask us for a copy of the safeguards in place at support@lyolog.app.
Outside our instructions
Microsoft belongs on this page because it receives data, but it does not belong in the table above, because it does not act on our instructions.
| Third party | Function | Where | Basis |
|---|---|---|---|
| Microsoft Ireland Operations Limited | Microsoft Clarity: session recordings and heatmaps of the website, only if you accept analytics cookies | Ireland, with onward transfers to the United States made by Microsoft within its own group | We disclose to Microsoft on the basis of your consent. The onward transfer to the United States is Microsoft’s own, under safeguards Microsoft puts in place as an independent controller |
| Cloudflare, Inc. | Improving Turnstile’s bot detection with the signals read on our form pages (IP address, TLS fingerprint, user agent) | Global | Cloudflare’s own legitimate interest, as independent controller, under its Turnstile Privacy Addendum. For bot detection itself, Cloudflare is our processor (table above) |
Under Microsoft’s own terms for Clarity, Microsoft and the site operator are independent controllers. Microsoft decides for itself what it does with the data Clarity collects, under the Microsoft Privacy Statement. There is no Article 28 contract for this, because Article 28 governs processors and Microsoft is not one.
Clarity runs on our public website pages only — never on the LyoLog app, the signed-in console, or the sign-in page.
Apple and Google, when you sign in with them or buy in their store
Apple and Google do not process this data on our instructions but as independent controllers, within your own relationship with them. They are involved only if you choose to sign in with their account or buy your subscription in their store.
| Third party | Function | Where | Basis |
|---|---|---|---|
| Apple Distribution International Limited | Sign in with Apple, if you choose it; sale and collection of App Store subscriptions, as seller | Ireland, with transfers to the United States made by Apple | Apple processes this data as an independent controller, under its own privacy policy. When you sign in, we receive from Apple only an identifier and the email you choose to share, which may be an Apple relay address |
| Google Ireland Limited | Sign in with Google, if you choose it | Ireland, with transfers to the United States | Google processes this data as an independent controller, under its own privacy policy |
| Google Commerce Limited | Sale and collection of Google Play subscriptions, as seller | Ireland, with transfers to the United States | Independent controller, under its own privacy policy |
Controller: Jan Panek · NIF Y2362080V · Rotonda de Versalles 23, 28512 Villar del Olmo, Madrid, Spain · support@lyolog.app
Version 1.3 — in force from 29 October 2026