Subprocessors
Last updated: 10/06/2026
ArizenLab S.r.l.s., which operates the Chamelix Platform, uses a small number of third-party service providers ("subprocessors") to operate the Platform. This page lists the subprocessors that may process personal data on our behalf, the purpose of each, the categories of data involved, and the status of the data-protection agreements in place.
The set of subprocessors below is derived from the Platform's actual integrations. Hosting regions and international-transfer mechanisms must be confirmed in each provider's contract and are marked accordingly. Where a row says to be verified, the contractual evidence is being finalized and will be updated here.
Current subprocessors
| Provider | Purpose | Data processed | Region | DPA / transfer status | | --- | --- | --- | --- | --- | | Vercel | Application hosting, serverless functions, scheduled jobs, bot protection | Request data, application logs | to be verified | DPA — to be verified | | Neon | PostgreSQL database | All persisted personal data, including membership and audit records | to be verified (EU preferred) | DPA — to be verified | | Google Firebase / Google Cloud Storage | Private file storage for medical/fitness certificates, avatars, and audio | Health-certificate PDFs (special-category), profile images | to be verified (EU preferred) | DPA / SCC — to be verified | | Stripe | Payments and subscription billing | Billing identity, customer identifiers | to be verified | DPA / SCC — to be verified | | Sentry | Error monitoring | Error events (PII-scrubbed), pseudonymized identifiers | to be verified (EU region preferred) | DPA / SCC — to be verified | | Resend | Transactional email delivery | Email address, message content | to be verified | DPA / SCC — to be verified | | Meta Platforms (WhatsApp Cloud API) | Transactional messages, where enabled by an organization | Phone number (hashed at rest), message template parameters | United States | SCC required — to be verified | | Google (OAuth, Maps, Analytics) | Social login, address lookup, consent-based analytics | Email/profile (login), address strings (maps), pseudonymous usage (analytics, consent only) | United States | SCC — to be verified |
We may also use an SMTP provider as a fallback for email delivery; where this is active it processes the same categories as our primary email subprocessor.
Changes to this list
When we add or replace a subprocessor, we update this page and provide business customers with the prior notice agreed in their Data Processing Addendum. If you are a business customer and would like to be notified of subprocessor changes, contact us at the address below.
Contact
Questions about subprocessors: app@chamelix.it