LegalSub-processor List
Sub-processor List
1. Purpose
Optimal uses the sub-processors below to operate the Services, including the pregnancy-nutrition planner, account surfaces, AI assistant, community forum, email and notifications, and related infrastructure.
This is the public list of current vendors. Elsewhere in our legal documents we use role labels so a provider can be substituted without rewriting every policy. If you need the current name behind a role, it is here.
2. Active Sub-Processors
| Provider role | Current vendor | Purpose | Typical data | Primary region |
|---|---|---|---|---|
| Authentication Provider | Clerk, Inc. | Sign-up, sign-in, account identity, and account sessions | Email, name or profile metadata, authentication identifiers, session tokens | United States |
| Webhook Transport | Svix | Delivers Authentication Provider lifecycle messages so we can open and close accounts | Lifecycle payloads needed to provision or close an account | United States |
| Database Provider | Supabase, Inc. | Stores planner, journal, profile, AI conversation, and related account data | Account and health-related application data | United States |
| Hosting Provider | Vercel, Inc. | Hosts the web application. May include limited page-view or performance telemetry | Request metadata, cookies needed to run the site, optional page-view or performance events (not meal or health content) | United States and global edge |
| CDN / Edge Network Provider | Cloudflare, Inc. | DNS, content delivery, edge network, and visit counting on the public website | IP addresses, request headers, and proxied traffic | Global |
| Cloud Infrastructure Provider | Google Cloud (Cloud Run / Cloud Storage) | Backend compute and object storage | Account and health-related data processed in the backend; stored objects where used | United States |
| Email Delivery Provider | Amazon Web Services, Inc. (Amazon SES) | Transactional email | Recipient email address, message content, delivery metadata | Region selected for email delivery |
| AI Model Providers | Anthropic, xAI, and OpenAI | Generative AI assistant. Prompts may include conversation text and health-context snippets | Conversation content, optional health-context snippets, and model metadata | United States |
| Community Platform Provider | Discourse | Community forum, including forum sign-in | Forum identity, posts, uploads, and forum profile | Forum host region |
| Email Design Provider | None | Operator-side email template design | Template assets and limited operational metadata. Not end-user meal or health logs | Provider regions |
| Billing Provider | Stripe, Inc. | Payment instrument collection, authorization, and settlement for paid plans | Billing email, subscription status, payment method metadata (for example card brand or last four digits where returned), country, failure codes. | United States and other regions Stripe operates in |
| Reverse-Geocoding Provider | BigDataCloud | Converts device coordinates to country or region labels | Coordinates are transmitted, not stored by us. Country or region may be saved | Global |
| Push Delivery (Web) | VAPID / Web Push (browser push; no push SaaS) | Browser push for devices you opt in | Push subscription endpoint, keys, and notification payloads as configured | Device and our systems |
| Push Delivery (Native app) | Firebase Cloud Messaging | Native push when the mobile app channel is used | Device tokens and notification payloads as configured | United States, and the device |
| Support Ticketing Provider | Help Scout PBC | Support ticket inbox, case management, and live chat (Beacon) | Support request content, requester email and name | Configurable |
3. Not Personal-Data Processors
| Role | Source | Note |
|---|---|---|
| Nutrient Data Source | USDA FoodData Central | Public nutrient composition catalog used for food data and scores. This is a data source, not a sub-processor of Personal Data. |
4. Not Used Today
We do not currently engage the following for the Services:
- Third-party ad networks
- Session replay or heatmapping SaaS
- Marketing analytics pixels
- Error-tracking or crash-reporting SaaS
- CAPTCHA or bot-mitigation SaaS
Hosting Provider page telemetry, if enabled, is disclosed under Hosting Provider in the table above. It is not a separate adtech vendor.
Browser push uses VAPID / Web Push with no push SaaS. Native push, when the mobile app channel is used, is listed above as Push Delivery (Native app).
5. International Transfers
Several providers are based primarily in the United States, with global edge delivery where noted. Where Personal Data (including Special Category Health Data) is transferred internationally, we use appropriate safeguards, including Standard Contractual Clauses, the UK International Data Transfer Addendum (IDTA) where required, and provider data-processing terms. More detail is in the Privacy Policy.
6. Changes
We will update this list when vendors change. For a material new sub-processor, or a material change to purpose or transfer risk, we will notify you as described in the Privacy Policy. Where the law gives you a right to object, contact [email protected].
7. Contact
| Topic | Contact |
|---|---|
| Questions about this list | [email protected] |
| Security questions | [email protected] |
See also the Privacy Policy, Records of Processing, and Data Subject Request Procedure.