Sub-processors

Last updated: October 28, 2026 — the Google LLC row no longer calls the App’s usage analytics anonymised: they are linked to IDs for the App on your phone (Privacy Policy § 1.3); the Meta Platforms, Inc. row now also covers Meta’s Model API, which chooses or paints a picture for each new meditation only if you turn on personal worlds in the App, and we added Baseten Labs, Inc., which runs the check of a new picture for that feature. Previous revision (October 19, 2026): the Google LLC row (Gemini API) now also covers descriptions of photos you add to a meditation, and the OpenAI, LLC row the description of your photo when Gemini is unavailable (never the photo itself). The rows for Inworld AI, Inc., Lambda, Inc. and Replicate, Inc. now say that the AI-written script they receive can repeat a few of your own words. Previous revision (October 12, 2026): the website analytics & ad measurement section now depends on where you are: Google Analytics and Google Ads measurement need your consent in the EU/EEA, the UK, Switzerland, Québec and other opt-in regions, and are on by default elsewhere with an easy switch-off; the Meta Pixel still runs only with your consent. Added Cloudflare, Inc., the network and security provider every request to elynd.app passes through. Previous revision (October 4, 2026): added Lambda, Inc. (GPU servers that render narration for some of our voices and, only if you set it up, for My voice, the optional feature that narrates your meditations in your own voice) and Replicate (narration for the Korra voice); removed Murf AI, Inc., which no longer renders any narration for ELYND. Previous revision (June 16, 2026): expanded the Apple Inc. row to cover Apple Ads (App Store Search Ads) attribution via Apple's first-party AdServices framework and SKAdNetwork (no IDFA, no App Tracking Transparency prompt). Previous revision (May 23, 2026): added Meta Platforms, Inc. to the App sub-processor list for app-install ad attribution (SKAdNetwork on iOS, no IDFA; advertising ID on Android).

Comads OÜ (registry code 17276947), the entity behind Elynd, uses a small number of third-party vendors ("sub-processors") to operate the App. A sub-processor is any third party we allow to process personal data on our behalf in the course of delivering the service.

This page is the authoritative, current list. We update it whenever we add, remove, or materially change a sub-processor. For the legal framework governing these relationships, see our Privacy Policy.

Current sub-processors

Vendor Purpose / data received Transfer mechanism
Google LLC United States Firebase (Authentication, Cloud Messaging, Analytics) — account creation and sign-in, push-notification delivery, and usage analytics of the App (what Firebase Analytics receives: Privacy Policy § 1.3). Account and session data are stored in our own EU-hosted database, not in Firebase.

Gemini API — generation of personalised meditation content, scripts, recommendations, and AI-powered conversational features, and descriptions of photos you add (each photo is sent once and never stored). We use the paid Gemini API, under which API inputs and outputs are not used to train Google's models. 		SCCs · DPF
Functional Software, Inc. (Sentry) United States Application error and performance monitoring for the ELYND app and backend. Receives crash reports, error messages and diagnostic traces. Personal data is suppressed: user identity and request bodies are not transmitted, and email addresses and credentials are redacted from message text before it leaves our servers. SCCs · DPF
Inworld AI, Inc. United States Text-to-speech voice synthesis for meditation narration (a portion of our narrator voice catalogue). We send only the AI-written script, which can repeat a few of your own words, to be rendered into audio; no account identifiers or emails. SCCs · DPF
Lambda, Inc. United States GPU servers on which we run our own voice models to render meditation narration (the Atlas, Michael and Orin voices). We send only the AI-written script, which can repeat a few of your own words, and no account identifiers or emails. My voice (optional, only if you set it up): your voice recording is also sent, encrypted in transit, for the length of each rendering, is used only to narrate your own meditations, and is never used to train any model. It is stored encrypted in our EU database, not by Lambda. See § 1.7 of our Privacy Policy. SCCs
Replicate, Inc. United States Text-to-speech voice synthesis for meditation narration (the Korra voice). We send only the AI-written script, which can repeat a few of your own words, to be rendered into audio; no account identifiers or emails. SCCs
OpenAI, LLC United States Fallback AI provider for the same meditation-content generation purpose, used only if Gemini is unavailable, together with the description of your photo if you added one (never the photo itself). OpenAI's API data-usage policy states that API inputs are not used to train their models. SCCs · DPF
Amazon Web Services, Inc. European Union — Frankfurt, Germany Backend hosting (EC2) for the Elynd API server, object storage (S3) for meditation-session audio, and content delivery (CloudFront) for streaming that audio to your device. All Elynd resources are deployed in the AWS eu-central-1 region, so this processing stays within the European Economic Area. Intra-EEA
Cloudflare, Inc. United States Content delivery, proxy and security (protection against attacks and bots) for the elynd.app website: every request to elynd.app passes through Cloudflare, which receives your IP address and the request details (such as the page requested and browser headers) to deliver and protect it, and may set short-lived security cookies (see our Cookie Policy). It also tells our server your country and, where it can, your state or province, so the website can choose the right cookie defaults; we do not keep this. SCCs · DPF
Apple Inc. United States Sign in with Apple (authentication on iOS), App Store in-app purchases (Pro-tier subscription processing), and Apple Ads (App Store Search Ads) attribution. Apple receives only what is required to identify your account and process your purchase. For Apple Ads we use Apple's first-party AdServices framework to learn which campaign or keyword led to an install — with no IDFA and no App Tracking Transparency prompt; the campaign/keyword identifiers (never your name, email, mood notes, or session content) are recorded in our analytics, and iOS install conversions are also measured in aggregate via Apple's privacy-preserving SKAdNetwork. SCCs · DPF
Meta Platforms, Inc. United States Measurement and attribution of our app-install advertising — so we can tell how many people who saw an Elynd ad went on to install and register. Receives app events (install, account registration, and that a meditation session started) plus device and usage data. On Android the device advertising ID (GAID) may be used; on iOS we do not request App Tracking Transparency and collect no IDFA — attribution there uses Apple's privacy-preserving SKAdNetwork, which does not identify you across other companies' apps. For this measurement we never send Meta your name, email, mood notes, or session content.

Model API (only if you turn on personal worlds, the optional part of Painted worlds in which Meta’s AI models choose the place or paint a new one; see § 1.10 of our Privacy Policy) — Meta’s AI models choose the place from our library, or design and paint a new one and cut it into layers. We send only the written meditation, which can repeat a few of your own words, with its technique, language and length, and a code made from your account that Meta cannot trace back to you; no names, emails or account IDs. Meta processes this as our processor and does not use it to train its models. The pictures are stored in our EU storage, not by Meta. 		SCCs · DPF
Baseten Labs, Inc. United States Only if you turn on personal worlds (see § 1.10 of our Privacy Policy): runs Meta’s open model Muse Spark Open, which checks each new picture before it is shown (calm, no text, any person or animal painted naturally). We send only the picture and a short description of the place; never the meditation, your words, names, emails or account IDs. Baseten processes this as our processor and does not use it to train models. SCCs

Website analytics & marketing (optional · depends on your region)

The providers in this section apply only to visitors of this marketing website (elynd.app) — not to users of the Elynd mobile App. In the EU/EEA, the UK, Switzerland, Québec and other opt-in regions they are never loaded without your consent. In the US (except Washington and Nevada), Canada (except Québec), Australia, New Zealand, Singapore and South Africa, Google Analytics and Google Ads measurement are on by default and you can switch them off at any time. If we cannot tell a visitor’s state or province, US visitors get these defaults and Canadian visitors the banner. The Meta Pixel only ever runs with your consent. Change your choice via Cookie Settings or Your Privacy Choices, and read how each category is used in our Cookie Policy.

We list these vendors here even when not active so that, if we enable them in the future, the disclosure is already complete. Each row's Status column reflects the current state of this website.

Vendor Purpose / data received Transfer Status
Google LLC United States Google Analytics 4 and Google Ads measurement — aggregated website traffic analytics (pages viewed, clicks such as on our store buttons, session duration, approximate country, device type) and measurement of whether our Google ads lead to visits and store clicks. GA4 does not log or store IP addresses. Google signals and ad personalisation are off, so no cross-device advertising profile is built from our site. Applies to the website only, not to the App. SCCs · DPF Active With consent in opt-in regions; on by default elsewhere.
Meta Platforms, Inc. United States Meta Pixel — measurement of the effectiveness of Elynd advertising on Facebook and Instagram, and matching of website visits to Meta ad accounts for campaign reporting. Applies to the website only, not to the App. SCCs · DPF Not yet enabled

Understanding the transfer mechanism

Comads OÜ is established in Estonia (EU). Amazon Web Services processes our backend data in its Frankfurt (eu-central-1) region, so that processing stays within the European Economic Area and does not require a Chapter V transfer mechanism. The remaining vendors above are located in the United States; each data transfer to those vendors relies on one of the safeguards recognised under GDPR Chapter V:

Changes to this list

We maintain this page as the current source of truth. If we add a new sub-processor that will process personal data, we will update this page and, where required by applicable law, notify you through the App or by email before the new sub-processor begins processing.

Objecting to a new sub-processor

If you object to a new sub-processor we have added, please contact us at [email protected]. Because sub-processors are integral to the service, the only guaranteed remedy we can offer where we cannot reasonably accommodate an objection is termination of your subscription and deletion of your account.

Contact

Email: [email protected]

Address: Comads OÜ, Ahtri St. 12, 15551 Tallinn, Estonia

Registry code: 17276947