Sub-processors
Last updated: June 16, 2026 — expanded the Apple Inc. row to cover Apple Ads (App Store Search Ads) attribution via Apple's first-party AdServices framework and SKAdNetwork (no IDFA, no App Tracking Transparency prompt). Previous revision (May 23, 2026): added Meta Platforms, Inc. to the App sub-processor list for app-install ad attribution (SKAdNetwork on iOS, no IDFA; advertising ID on Android).
Comads OÜ (registry code 17276947), the entity behind Elynd, uses a small number of third-party vendors ("sub-processors") to operate the App. A sub-processor is any third party we allow to process personal data on our behalf in the course of delivering the service.
This page is the authoritative, current list. We update it whenever we add, remove, or materially change a sub-processor. For the legal framework governing these relationships, see our Privacy Policy.
Current sub-processors
| Vendor | Purpose / data received | Transfer mechanism |
|---|---|---|
| Google LLC United States |
Firebase (Authentication, Cloud Firestore, Cloud Messaging, Analytics) — account creation and sign-in, secure cloud storage of account and session data, push-notification delivery, and anonymised usage analytics.
Gemini API — generation of personalised meditation content, scripts, recommendations, and AI-powered conversational features. We use the paid Gemini API, under which API inputs and outputs are not used to train Google's models. |
SCCs · DPF |
| Murf AI, Inc. United States | Text-to-speech voice synthesis for meditation narration (a portion of our narrator voice catalogue). We send the generated meditation script text to be rendered into audio. No account identifiers, emails, or user-authored free text are sent — only the AI-generated script content. | SCCs · DPF |
| Inworld AI, Inc. United States | Text-to-speech voice synthesis for meditation narration (a portion of our narrator voice catalogue). We send the generated meditation script text to be rendered into audio. No account identifiers, emails, or user-authored free text are sent — only the AI-generated script content. | SCCs · DPF |
| OpenAI, LLC United States | Fallback AI provider used when the primary service (Gemini) is unavailable, for the same meditation-content generation purpose. OpenAI's API data-usage policy states that API inputs are not used to train their models. | SCCs · DPF |
| Amazon Web Services, Inc. European Union — Frankfurt, Germany |
Backend hosting (EC2) for the Elynd API server, object storage (S3) for meditation-session audio, and content delivery (CloudFront) for streaming that audio to your device. All Elynd resources are deployed in the AWS eu-central-1 region, so this processing stays within the European Economic Area.
|
Intra-EEA |
| Apple Inc. United States | Sign in with Apple (authentication on iOS), App Store in-app purchases (Pro-tier subscription processing), and Apple Ads (App Store Search Ads) attribution. Apple receives only what is required to identify your account and process your purchase. For Apple Ads we use Apple's first-party AdServices framework to learn which campaign or keyword led to an install — with no IDFA and no App Tracking Transparency prompt; the campaign/keyword identifiers (never your name, email, mood notes, or session content) are recorded in our analytics, and iOS install conversions are also measured in aggregate via Apple's privacy-preserving SKAdNetwork. | SCCs · DPF |
| Meta Platforms, Inc. United States | Measurement and attribution of our app-install advertising — so we can tell how many people who saw an Elynd ad went on to install and register. Receives app events (install, account registration, and that a meditation session started) plus device and usage data. On Android the device advertising ID (GAID) may be used; on iOS we do not request App Tracking Transparency and collect no IDFA — attribution there uses Apple's privacy-preserving SKAdNetwork, which does not identify you across other companies' apps. We never send Meta your name, email, mood notes, or session content. | SCCs · DPF |
Website analytics & marketing (optional · consent-gated)
elynd.app) — not to users of the Elynd mobile App. They are never loaded without your consent. You can grant or withdraw consent at any time via Cookie Settings, and you can read how each category is used in our Cookie Policy.
We list these vendors here even when not active so that, if we enable them in the future, the disclosure is already complete and you can make an informed choice before any data is collected. Each row's Status column reflects the current state of this website.
| Vendor | Purpose / data received | Transfer | Status |
|---|---|---|---|
| Google LLC United States | Google Analytics 4 — aggregated, privacy-hardened website traffic analytics (pages viewed, session duration, approximate country, device type). We enable IP anonymisation and disable Google Signals, so no cross-device advertising profile is built from our site. Applies to the website only, not to the App. | SCCs · DPF | Active (with consent) |
| Meta Platforms, Inc. United States | Meta Pixel — measurement of the effectiveness of Elynd advertising on Facebook and Instagram, and matching of website visits to Meta ad accounts for campaign reporting. Applies to the website only, not to the App. | SCCs · DPF | Not yet enabled |
Understanding the transfer mechanism
Comads OÜ is established in Estonia (EU). Amazon Web Services processes our backend data in its Frankfurt (eu-central-1) region, so that processing stays within the European Economic Area and does not require a Chapter V transfer mechanism. The remaining vendors above are located in the United States; each data transfer to those vendors relies on one of the safeguards recognised under GDPR Chapter V:
- SCCs — Standard Contractual Clauses approved by the European Commission. We have SCCs in place with each vendor, either through their standard data-processing agreement or through the vendor's terms of service.
- DPF — EU-U.S. Data Privacy Framework. Where a vendor is self-certified under the DPF, that certification provides an additional adequacy basis for the transfer.
Changes to this list
We maintain this page as the current source of truth. If we add a new sub-processor that will process personal data, we will update this page and, where required by applicable law, notify you through the App or by email before the new sub-processor begins processing.
Objecting to a new sub-processor
If you object to a new sub-processor we have added, please contact us at [email protected]. Because sub-processors are integral to the service, the only guaranteed remedy we can offer where we cannot reasonably accommodate an objection is termination of your subscription and deletion of your account.
Contact
Email: [email protected]
Address: Comads OÜ, Ahtri St. 12, 15551 Tallinn, Estonia
Registry code: 17276947