Sub-processors
- Effective from
- 8 August 2026
- Last updated
- 8 August 2026
- Version
- 1.0
In short
- Your data sits in Frankfurt, Germany.
- Every supplier below has a data processing agreement with us.
- There is no ad network, attribution SDK, analytics SDK or data broker on this list — and that's the point.
- Several suppliers are American legal entities. What that means is at the bottom of this page.
Running Mensis requires a small number of suppliers. They're all listed below, with what they do, where the data sits and on what basis any transfer outside the EU takes place.
We update this page whenever something changes. If we add a supplier that processes health or deen data, we announce it in the app beforehand.
Suppliers for the app
| Supplier | Role | Data location | Transfer basis |
|---|---|---|---|
| Supabase Inc. (US) | Database, authentication and server functions | Frankfurt, Germany (eu-central-1) | Standard contractual clauses module 2. Open source and self-hostable — that's our fallback route. |
| Amazon Web Services EMEA SARL | Underlying infrastructure and AI inference via Bedrock | EU regions; AI on a European inference profile | Standard contractual clauses; EU-US Data Privacy Framework where applicable |
| Anthropic PBC (US) | Provider of the language model behind the AI assistant | Processing via the EU route of AWS Bedrock | Contractually fixed: no training on our data, no retention of messages |
| Apple Inc. (US) | Sign in with Apple, App Store distribution, push notifications | US and EU | EU-US Data Privacy Framework |
| Google LLC (US) | Google Sign-In, Google Play distribution | US and EU | EU-US Data Privacy Framework |
| RevenueCat, Inc. (US) | Subscription management across both stores | US | Standard contractual clauses. Receives only your user id and your subscription status — never email, health or deen data. |
| Functional Software, Inc. (Sentry, US) | Crash reporting | Frankfurt, Germany (EU instance) | Standard contractual clauses. Receives no contents of your logs. |
Suppliers for this website
This website is separate from the app and processes considerably less. No analytics runs and no cookies are set that would require consent.
| Supplier | Role | Data location | Transfer basis |
|---|---|---|---|
| Our hosting provider | Serving this website and technical logs (including IP address) for availability and abuse prevention | EU region | Standard contractual clauses where the party is established outside the EU |
What we deliberately don't use
- No ad networks and no advertising SDKs
- No attribution or install-tracking SDKs
- No analytics SDKs in the app
- No social media SDKs or pixels
- No data brokers
- No email processor for the app itself: there are no email accounts, and notifications are scheduled locally on your device
On American suppliers and the CLOUD Act
Several parties above are legal entities established in the United States, even though the data sits in Europe. The American CLOUD Act can compel such companies to hand over data under their control, regardless of where that data physically sits.
Standard contractual clauses and the Data Privacy Framework reduce that risk but don't remove it entirely. We think you should know that before you use the app, rather than finding out yourself.
The full solution is a chain of exclusively European parties: self-hosted infrastructure at a European provider. That's technically possible — Supabase is open source and self-hostable — and it's our documented fallback route. It isn't our launch choice, because we can't currently guarantee running it at the required standard.