UNDA — Sub-processor Register

Status: Draft. Add an entry before wiring any vendor that can receive personal data.

Current processors (production)

None. The prototype is fully local. No user data leaves the device.

Purpose: Optional cross-device sync of profile, cycle_days, workout_sessions.
Data categories: IDENTITY (email for magic-link login), SENSITIVE_HEALTH (cycle + symptoms), FITNESS (workout sessions).
Sensitive data? Yes.
EU/EEA location: Yes (must configure eu-west region).
Transfer mechanism if outside EEA: N/A if EU-hosted; do not use US-hosted Supabase project without SCC review.
Retention: Aligned to retention-policy.md.
Subprocessors: AWS (via Supabase). Review Supabase's subprocessor list before signing.
DPA signed/reviewed: Pending — required before beta.
Security review: Pending — TLS, RLS policies audit, backup/restore test.
Deletion support: Row-level delete via RLS-permitted DELETE + backup rotation confirmation.
Owner: Product engineering.

Purpose: Read completed activities (F4 planned).
Data categories: FITNESS (workouts, HR where present), potentially SENSITIVE_HEALTH (HR at rest, TRIMP/TSS).
EU/EEA location: No — US-based. Requires SCCs and a Transfer Impact Assessment before wiring.
Retention: UNDA retains only the fields per data-inventory.md — never full API payload.
DPA signed/reviewed: Pending.
Owner: Product engineering.

Purpose:
- Read: pull recent activities into imported_activities; read planned events for the Today card's suggestion override.
- Write: push UNDA-planned workouts onto the user's Intervals calendar (name, description with step-by-step body, type, duration, target date). No cycle or symptom data is ever sent.
Data categories out: FITNESS (workout titles, descriptions, duration, activity type). No IDENTITY, no SENSITIVE_HEALTH beyond what the user's own Intervals account already contains.
Sensitive data? No new sensitive fields sent.
EU/EEA location: To confirm — Intervals.icu is UK-hosted per public docs (Cloudflare + AWS backing). UK GDPR-adequate as of the current EU adequacy decision.
Auth model: User pastes API key from intervals.icu/settings/developer. Stored via flutter_secure_storage (Keychain / EncryptedSharedPreferences). Never in the sqflite DB.
DPA signed/reviewed: Pending — must be signed before beta. Intervals.icu operates as a data controller for the user's activities; UNDA acts as an authorised client on the user's behalf, so this is closer to an API-consumer relationship than a processor one. Confirm with counsel.
Retention: Imported activities live in imported_activities (user-controlled, wiped on disconnect per §8.4). Pushed events live in pushed_intervals_events (bookkeeping only, wiped on delete-account).
Owner: Product engineering.

Note: These are not processors — data stays on-device with the user's permission. But we still record scopes and behaviour.
Scopes to be requested at minimum-necessary time: workouts, HR, RHR, HRV, sleep. NOT contacts/location/messages.

Firebase Analytics / Google Analytics / Mixpanel / Amplitude / PostHog / Segment — no product analytics wired at this time; if added, entry must come with an event allowlist review.
Sentry / Crashlytics — not wired. If added, scrubbers must be configured per §6.3 before receiving traffic.
Advertising SDKs — never (§5.5).
Data brokers — never.

Before opening a PR that adds a new vendor: