Skip to content
Being Optimal

LegalSub-processor List

Sub-processor List

Version 1.0.0-draft · Effective 2026-07-13 · Operator [PENDING: LEGAL_ENTITY_NAME]

Operator draft — not legal advice; counsel review required before relying on this text.

1. Purpose of this list

Being Optimal engages the following sub-processors to operate the Services (pregnancy-nutrition planner, account surfaces, AI assistant, community forum where enabled, help/content delivery, and related infrastructure).

This document is the sole public place that names vendors. Elsewhere in the suite, documents stay vendor-agnostic so providers can be substituted without re-drafting; transparency for data subjects and regulators is preserved here.

2. Active sub-processors

Provider role Sub-processor (current vendor) Purpose Data categories (typical) Primary region(s)
Authentication Provider Clerk, Inc. Sign-up, sign-in, sessions, account identity; lifecycle webhooks Email, name/profile metadata, authentication identifiers, session tokens United States (provider-dependent)
Webhook Transport Svix (via Clerk) Delivery of Authentication Provider webhooks (e.g., user.created, user.deleted) used for provisioning and deprovision Webhook payloads; user lifecycle events United States (provider-dependent)
Database Provider Supabase, Inc. Primary application database; row-level security (RLS) with user JWT Health/profile data, environments, meals, journal, templates/combos, AI conversation content, preferences, entitlements metadata Primarily United States
Hosting Provider Vercel, Inc. Hosting of the Next.js application (public site + signed-in shell); may include Vercel Web Analytics (page-view / performance telemetry) when the app enables it HTTP request metadata, session cookies, application logs; optional analytics events (path, referrer, device class — not meal/health content) United States / global edge
CDN / Edge Network Provider Cloudflare, Inc. DNS, CDN, edge/gateway for privileged backend access IP addresses, request headers, geo signals, proxied traffic Global
Cloud Infrastructure Provider Google Cloud (Cloud Run, Cloud Storage / GCS) Privileged backend APIs (provisioning, deprovision, heavy compute), object storage (e.g., community uploads where used) Backend-processed account and health-related data; stored objects Primarily United States
Email Delivery Provider Amazon Web Services, Inc. (Amazon SES) Transactional email delivery Recipient email address, message subject/body, delivery metadata Configurable (operator-selected region)
AI Model Providers Anthropic, xAI, OpenAI Generative AI assistant (“Borg”); prompts may include conversation text and health-context snippets Conversation content; optional Special Category Health Data snippets; model metadata Primarily United States
Community Platform Provider Discourse Hosted community forum with SSO Identity used for SSO, forum posts, uploads, forum profile Configurable (forum host region)
Email Design Provider Stripo Operator-side email template design tooling Template assets; limited operational metadata (not end-user meal/health logs) Operator / provider regions
Reverse-Geocoding Provider BigDataCloud Convert device raw latitude/longitude to country/region labels Raw lat/lng transmitted transiently; Being Optimal does not store GPS coordinates — only country/region (or similar place labels) may be persisted Global (API)
Billing Provider Clearway (placeholder — not yet live) Subscription billing / merchant-of-record when paid plans go live Billing email, subscription status, payment references — Being Optimal does not store full payment card numbers TBD when live
Push Delivery VAPID / Web Push (browser push; no third-party push SaaS) Browser push notifications for opted-in devices Push subscription endpoint, cryptographic keys, notification payloads as configured Device / browser; endpoint stored in our database

3. Data sources that are not personal-data processors

Role Source Note
Nutrient Data Source USDA FoodData Central Public nutrient composition catalog used to power food data and scores. This is a data source, not a Sub-processor of Personal Data. No user health profiles are sent to USDA as part of catalog use.

4. Explicitly absent (not used today)

Being Optimal does not currently engage the following categories of third parties for the Services:

Category Status
Third-party marketing analytics / ad pixels / session replay Absent — no marketing analytics SaaS, ad networks, or session replay. Note: Hosting Provider page telemetry (Vercel Web Analytics) may be present as part of hosting; first-party consent-gated catalog analytics is separate
Third-party error-tracking / crash-reporting SaaS Absent
Advertising networks / ad pixels Absent
Session-replay / heatmapping SaaS Absent
CAPTCHA / bot-mitigation SaaS Absent
Third-party push notification SaaS Absent — browser VAPID/Web Push only

If any of these are added later, they will be named in this list and users will be notified as required by the Privacy Policy and Versioning And Acceptance.

5. How data flows (summary)

  1. You authenticate via the Authentication Provider (Clerk). Lifecycle events may be delivered via Svix webhooks to our backend.
  2. Application data (meals, journal, health profile, AI conversations, etc.) is stored with the Database Provider under RLS keyed to your authenticated identity.
  3. The web app is served by the Hosting Provider; edge/DNS may involve the CDN / Edge Network Provider.
  4. Privileged operations (account provisioning/deprovision, heavy compute) run on Cloud Infrastructure Provider (Google Cloud Run); service-role access is confined to that privileged backend — not to the Next.js frontend host.
  5. AI assistant may send prompts (including health-context snippets) to AI Model Providers; conversation content may also be persisted in our database.
  6. Location: if you use reverse-geocoding features, raw coordinates are sent to BigDataCloud; we store place labels (e.g., country/region), not GPS.
  7. Community: forum identity/posts are handled by Discourse (SSO identity only for product health fields that are gated off).
  8. Email / push: transactional mail via Amazon SES; optional browser push via VAPID.

6. International transfers

Infrastructure and AI providers are primarily United States-based, with global edge delivery. Where Personal Data (including Special Category Health Data) is transferred internationally, we rely on appropriate safeguards (e.g., Standard Contractual Clauses, provider DPAs, and other mechanisms as required). Details of transfer posture are summarized in the Privacy Policy regional annexes and Records Of Processing.

7. Change notification (changeFeed: true)

Event Our practice
Material new sub-processor Update this list; provide notice per Privacy Policy; objection rights where applicable
Material change to processing purpose or transfer risk Same as above; may trigger re-acceptance per Versioning And Acceptance
Immaterial vendor rename / contact update Update this list; notice only

How to stay informed: monitor this page and the suite README changelog. Contact [email protected] to ask about change notifications or to raise an objection where the law provides one.

8. Sub-processor inquiries

Topic Contact
Sub-processor list, DPAs, transfer questions [email protected]
Security of our use of sub-processors [email protected]
Legal process directed at a vendor May need to contact that vendor; we can help scope — [email protected]