Subprocessors

Effective from 2026-10-02 · Version 1.1

This is an informational translation. In case of any discrepancy, the Polish version prevails.

Providers we entrust data to

A subprocessoris a provider to whom we, as a processor, onward-entrust our clients' data. Art. 28(2) GDPR requires that clients know who they are and can object — which is why this list is public and kept current.

ProviderPurposeProcessing location
Supabasedatabase, authentication, live syncIreland (eu-west-1)
Amazon Web Servicesinfrastructure under the databaseIreland (eu-west-1)
Sentryapplication error monitoringGermany (Frankfurt)
Vercelapplication hostingIreland (Dublin)
Resendoutbound emailIreland (eu-west-1)
Inngestbackground jobs and notificationsUnited States
Apple, Google, Mozillapush notification deliveryUnited States and othersoutside the EEA — payload encrypted, see below

Change policy

  1. We announce the addition of a new subprocessor at least 30 days in advance — on this page and by email to clients with whom we have a data processing agreement.
  2. A client has the right to raise a reasoned objection to a new subprocessor. If we cannot find a resolution, the client may terminate without adverse consequences.
  3. Every subprocessor is bound by obligations no less onerous than our own under the data processing agreement concluded with the client.
  4. Objections or questions: privacy@liverun.io.

Push notifications — an explanation

Apple, Google and Mozilla appear on this list, but their role differs from the others: we did not choose them and we have no contract with them. These are the push services built into the user's phone operating system, through which every notification must pass.

The notification payload is encrypted from our server to the specific device — they carry an encrypted package and a technical device identifier. In addition, a chat notification does not contain the message. Switching push notifications off ends this transfer entirely.