UNDA — Sub-processor Register

Status: Draft. Add an entry before wiring any vendor that can receive personal data.

Current processors (production)

None. The prototype is fully local. No user data leaves the device.

Purpose: Optional cross-device sync of profile, cycle_days, workout_sessions.
Data categories: IDENTITY (email for magic-link login), SENSITIVE_HEALTH (cycle + symptoms), FITNESS (workout sessions).
Sensitive data? Yes.
EU/EEA location: Yes (must configure eu-west region).
Transfer mechanism if outside EEA: N/A if EU-hosted; do not use US-hosted Supabase project without SCC review.
Retention: Aligned to retention-policy.md.
Subprocessors: AWS (via Supabase). Review Supabase's subprocessor list before signing.
DPA signed/reviewed: Pending — required before beta.
Security review: Pending — TLS, RLS policies audit, backup/restore test.
Deletion support: Row-level delete via RLS-permitted DELETE + backup rotation confirmation.
Owner: Product engineering.

Purpose: Read completed activities (F4 planned).
Data categories: FITNESS (workouts, HR where present), potentially SENSITIVE_HEALTH (HR at rest, TRIMP/TSS).
EU/EEA location: No — US-based. Requires SCCs and a Transfer Impact Assessment before wiring.
Retention: UNDA retains only the fields per data-inventory.md — never full API payload.
DPA signed/reviewed: Pending.
Owner: Product engineering.

Note: These are not processors — data stays on-device with the user's permission. But we still record scopes and behaviour.
Scopes to be requested at minimum-necessary time: workouts, HR, RHR, HRV, sleep. NOT contacts/location/messages.

Firebase Analytics / Google Analytics / Mixpanel / Amplitude / PostHog / Segment — no product analytics wired at this time; if added, entry must come with an event allowlist review.
Sentry / Crashlytics — not wired. If added, scrubbers must be configured per §6.3 before receiving traffic.
Advertising SDKs — never (§5.5).
Data brokers — never.

Before opening a PR that adds a new vendor: