Heliva · Legal
Sub-processors
The companies that process personal data for Heliva, what each one does, and where.
01The list
These companies process personal data on our behalf when you use Heliva. Each works under a data processing agreement with us, and stores data only in the EU/EEA. We don't transfer personal data outside the EU/EEA.
| Provider | Based in | What it does for Heliva | Where the data is |
|---|---|---|---|
| Hetzner Online GmbH | Germany | Hosts our server: the API, its database, backups, logs and this website. Also hosts our own crash reporting (GlitchTip) and usage statistics (Umami), which the app sends only if you turn them on, and the website's visit counts. | Finland (Helsinki); Germany (Nuremberg) for usage statistics |
| Google Cloud EMEA Limited | Ireland | Runs the Gemini AI models that read meal photos, typed and spoken meals, nutrition labels and recipes, match food names and write meal plans. Requests aren't stored by us or cached by Google. Google may keep requests its classifiers flag for up to 90 days, in the EU, to check for abuse, and doesn't use them for training. | EU member states (Google Cloud's EU multi-region) |
| Migadu-Mail GmbH | Switzerland | Hosts our email, including messages you send to support. Switzerland has an EU adequacy decision. | France |
02Not sub-processors
- Apple. The App Store handles payment, App Attest checks the app, and Apple Health and iCloud keep data on your devices and in your Apple account. Apple does these as its own controller, under the terms between you and Apple. Apple gives us signed purchase records; it doesn't process data for us.
- GlitchTip and Umami are open-source software that we run ourselves at Hetzner. No data goes to the projects behind them.
- Open Food Facts. Our server looks up barcode numbers in its database. Only the barcode number is sent, from our server, and nothing about you.
- The Swedish Food Agency (Livsmedelsverket). We use its food database. Nothing about you is sent to it.
- Recipe websites. When you share a recipe link, our server usually fetches that page. For sites that build their recipes with scripts, Heliva opens the page on your phone instead, as Safari would. Either way, the site is not processing data for us.
03Changes
We update this page at least 30 days before adding or replacing a sub-processor. Organisations with a Data Processing Agreement are also told by email. If you want to hear about changes, email support@heliva.app.
- Draft: first list.