Processors and transfers (DPA)
Controller: Inithex Consultoria Integral SPA · hello@inithex.com
How it works
A processor handles data only on behalf of Chabits and under our instructions, bound by a data processing agreement (DPA) that requires it to protect the data, not use it for anything else and help us honor your rights. An independent controller handles data under its own policy.
Supabase Inc. · processor
Server, database, sign-in, functions and prize photo storage. Location: United States (us-east-1). Safeguard: Supabase DPA with Standard Contractual Clauses.
OpenAI · processor
Calorie estimates from the photo or text you choose to send, only with your permission. Location: United States. Safeguard: OpenAI DPA with Standard Contractual Clauses. The provider applies its processing and retention policies to API inputs; zero retention is not promised.
Email provider · processor
Sends the verification code to your email. It only receives your address and the code. Safeguard: provider DPA with Standard Contractual Clauses.
Apple or Google Play · independent controllers
Processes the subscription payment and confirms its status to us. It receives your Chabits account ID when you buy, never your meals, photos or notes. Governed by the relevant store privacy policy.
Open Food Facts · independent controller
Open food database (France). It receives the barcode number you scan and your IP. Governed by its own policy.
Changes to providers
If we add or change a processor we will publish it here before it handles your data. You can ask for a copy of the safeguards at hello@inithex.com.