Subprocessors
To run Eliora we rely on a small set of trusted service providers (“subprocessors”). Each processes only the data needed for its function, under a written agreement — a data processing agreement or the provider’s terms of service — that limits its use of the data to providing the service and binds it to confidentiality and security obligations. We update this page before adding or changing a subprocessor.
Last updated 4 October 2026 · GreatLight Works Inc.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database, authentication & file storage | Account data, hub entries, reminders, Vault ciphertext, sign-in identity | USA / EU |
| Vercel | Web app hosting & delivery | IP address & request metadata; no app data stored | USA (global edge) |
| Render | Backend API hosting | Data in transit through the API; processing logs | USA |
| OpenAI | AI processing (classification, chat, vision, transcription) | Capture text & images submitted for processing; audio you record, when Groq is unavailable | USA |
| Groq | Speech-to-text (Whisper), the default transcriber for recordings | Audio you record in Eliora, and the text it returns | USA |
| Anthropic | AI processing (chat / reasoning) | Capture text submitted for processing | USA |
| AI processing; optional Calendar | Capture text; calendar data only if you connect Google Calendar | USA | |
| Resend | Transactional and consented email delivery; inbound email forwarding (capture) | Email addresses; outbound and inbound message content; delivery metadata | USA |
| Namecheap | Domain & mailbox (Private Email) | Domain DNS; mailbox contents | USA |
| Sentry | Error monitoring (crash reports), including the mobile app | Error events — technical details only (failing line, device, OS and app version); personal-information sending is disabled | USA |
| Google (Firebase Cloud Messaging) | Push-notification delivery to the Android app | Device push token + the minimum notification payload; sensitive personal content excluded from remote push payloads | USA (global infrastructure) |
| OtaKit | Live updates to the mobile app’s screens (download, install, roll back) | The phone’s IP address; platform, app and update version, and whether an update worked — never your content, account or identity | International (global delivery network, incl. USA) |
| Apple (Push Notification service) | Push-notification delivery to the iPhone app | Device push token + the minimum notification payload; sensitive personal content excluded from remote push payloads | USA (global infrastructure) |
| WeatherAPI.com | Weather forecast & city search for your daily brief and trips | Approximate coordinates or a city name, sent via our backend only if you enable weather | International (incl. USA) |
| Google News (RSS) | Headlines for the topics you follow in your daily brief | The topic you chose. Requested by our server, so your identity and IP are not sent | USA |
The AI providers (OpenAI, Anthropic, Google) process data via their APIs and do not use it to train their models. Files you place in the Vault are encrypted on your device — our storage provider holds only ciphertext it cannot read.
See also our Privacy Policy.