LIST OF PROCESSORS AND SUB-PROCESSORS

Last updated: September 2026

This overview lists the service providers that process personal data on our behalf (processors) or are engaged by a processor (sub-processors). We publish it voluntarily, in the interest of transparency. The controller within the meaning of the GDPR is solely ICOSO CONSULTING S.L. ("Luna FemTech"); details are in our Privacy Policy (www.luna-femtech.com/data).

Core principle: Your stored health records are encrypted on your device (AES-256-GCM) before they are stored or backed up; the exceptions are a few details for reminders and syncing listed in section 4 of the Privacy Policy. The optional AI coaching is a separate matter: for it, selected health information and chat texts are transmitted through our servers operated at Hetzner to AWS Bedrock and processed there in readable form. Details are given below and in the Privacy Policy.


A) PROCESSORS (processing on our behalf, Art. 28 GDPR)

• Hetzner Online GmbH (Germany, EU)
Purpose: hosting of the app servers and the database.
Data: account data (e.g. e-mail address), encrypted health records (ciphertext; for exceptions see above), technical logs, IP addresses (max. 7 days) and the pseudonymised check log for the AI chat (without conversation content). When the AI coaching is used, these servers forward the transmitted health information and chat texts to AWS Bedrock without storing them.
Location: Finland (EU). No third-country transfer.

• Amazon Web Services EMEA SARL (region eu-central-1, Frankfurt, EU)
Purpose: AI-assisted nutrition and lifestyle coaching ("Sofía", only when the optional AI features are used).
Data: selected health and profile information (categories, summarised values and individual measurements such as hormone values) and, in the chat, your messages with the recent conversation as free text, in which a filter replaces certain detected e-mail addresses, phone numbers and IBANs in your own messages — without the name, e-mail address and user ID of your account. Models: Claude (Anthropic).
Location: EU (requests via Frankfurt, processing in AWS regions within the EU). No transfer to the USA.

• Scaleway SAS (France, EU)
Purpose: sending transactional e-mails (e.g. verification and security codes) and keeping encrypted database backups.
Data: e-mail address and the content of the respective system e-mail; database backups, which are encrypted before transfer.
Location: France (EU). No third-country transfer.

• Sentry (Functional Software, Inc.)
Purpose: technical crash and error diagnostics (optional, can be turned off in Settings).
Data: technical crash reports; personal content is largely removed before sending (PII scrubbing).
Location: EU region only (Frankfurt), safeguarded by EU Standard Contractual Clauses.


B) SUB-PROCESSORS WITH THIRD-COUNTRY TRANSFER (USA, safeguarded by EU Standard Contractual Clauses)

• OpenAI, L.L.C. (USA)
Purpose: generation of recipe/dish images.
Data: only the textual search term or recipe name — no health data, no user ID.

• RevenueCat, Inc. (USA)
Purpose: technical management of subscriptions (purchase reconciliation, subscription status).
Data: pseudonymous subscription identifier (SHA-256) and subscription status — no clear name, no health data.


C) PAYMENT PROCESSING (each an independent controller)

• Apple (Apple Distribution International Ltd., Ireland / Apple Inc.) — purchase and billing via the App Store.
• Google (Google Ireland Ltd. / Google LLC) — purchase and billing via Google Play.
Payment is handled entirely by the respective store; we receive no bank, card or billing data. Their own privacy terms apply additionally.


D) TECHNICAL LOOKUP SERVICES (request relayed through our server, no personal data)

• Open Food Facts (non-profit, France)
Purpose: looking up a product name for a scanned barcode.
Data: only the scanned barcode number (EAN) — no personal reference.

• OpenStreetMap / Nominatim (OpenStreetMap Foundation, EU)
Purpose: place-entry suggestions (e.g. city search).
Data: only the entered search term — no location or GPS data, no personal reference.


We update this list whenever service providers change. The current version is published at www.luna-femtech.com/sub.