1. List of sub-processors
The providers below process personal data on our behalf. Google Analytics statistics and PostHog statistics with cookies, and Firebase notifications, only run if you accept or activate those features.
| Provider | Purpose | Data | Location | Safeguards |
|---|---|---|---|---|
| [A PREENCHER: fornecedor de alojamento e localização dos servidores na UE] | Hosting of the application, the database and the backups | All service data, encrypted at rest | EU | Data processing agreement (Article 28) |
| Stripe Payments Europe, Ltd. (Stripe group) | Payments, VAT and invoices | Email, name, billing and payment details. The card is handled directly by Stripe | Ireland (EU). May involve the US | Data processing agreement and Standard Contractual Clauses |
| Fortuly Cloud, with Amazon SES (eu-north-1 region, Stockholm) | Sending emails: login link, notices, reminders | Recipient’s email and message content | Sweden (EU) | Data processing agreement. Login links are not tracked |
| PostHog, EU instance | Product statistics, without names, emails, meals or diets | Usage events and a random identifier. No cookies until you accept | EU | Data processing agreement |
| Google Analytics (Google Ireland Limited) | Visit statistics, only after you accept | Identifier in a cookie, page visited, device | EU and US | Consent and Standard Contractual Clauses |
| Google Firebase Cloud Messaging | Notifications in the browser or app, only if you turn them on | Device identifier and notification text | US and other countries | Data processing agreement and Standard Contractual Clauses |
| OpenRouter, Inc. and the provider of the AI model chosen for each request | AI assistant (optional): replying to messages and proposing changes to the plan | Messages you write and an anonymous summary of the plan (codes instead of names). No emails, phone numbers, ages or private notes. We request providers that declare they do not store requests or train models on them | US and EU, depending on the provider chosen | Consent, data processing agreement and Standard Contractual Clauses |
| OpenStreetMap Foundation (Nominatim), through our servers | Event location (optional): searching for an address and finding the address of a point on the map | The text you search for or the coordinates of the point. Requests leave our servers without your account, without cookies and without your IP address | United Kingdom | Public, open service with no individual contract. We send only the search or the coordinates, never account data |
| OpenFreeMap | Event location (optional): the editor’s background map, only when you open “Set on the map” | Your browser requests the map directly from OpenFreeMap, which receives your IP address and the area you are viewing. It does not receive names, addresses or account data. Guests do not load the map | EU, with a global delivery network | Public, open service with no individual contract |
If the “Continue with Google” option is available and you use it, Google receives your login request and shares your name and email with us. In that case, Google processes that data as the controller of its own service.
2. International transfers
Hosting and backups are in the EU. When a provider processes data outside the European Economic Area, we require the European Commission’s Standard Contractual Clauses or another appropriate safeguard. If you would like a copy, request it at privacy@seatalia.com.
3. Changes
We notify Pro customers by email 30 days in advance before adding or replacing a sub-processor, so that they can object. This page always shows the list currently in force.