Service providers and recipients
Technical recipients, roles, regions and contract evidence for Zusio.
Supabase
Supabase provides authentication, Postgres, private file storage, Realtime and Edge Functions. The project database region is eu-west-1 (Ireland), confirmed from project metadata on 18 September 2026. Supabase states that DPA version 1 dated 1 August 2026 is incorporated automatically into its terms; the DPA and Transfer Impact Assessment are archived. Subprocessor changes, support access and the actual backup, log and retention settings are maintained in the provider register.
Apple and Google
Apple or Google processes a selected sign-in. Apple also processes StoreKit purchases and APNs delivery. Operating-system geocoding may involve Apple or Google, and Google Maps receives a location only when deliberately opened. Their independent-controller and provider roles must be assessed per activity.
RevenueCat
RevenueCat verifies and restores subscriptions and associates them with the Zusio UUID. Its August 2026 DPA, including the EU Standard Contractual Clauses, is archived. A V2 server key limited to customer read/write access is stored as an encrypted Supabase secret. The project currently uses only the Test Store; an Apple app and production products must be configured before live use. The account-deletion pipeline calls the RevenueCat customer deletion API; it does not cancel an Apple subscription.
Expo and push services
Expo and Apple Push Notification service process push tokens and payloads for delivery. Contract entity, subprocessors, locations and retention must be documented. Local reminders remain on the device.
Photon
The client contacts photon.komoot.io directly for enabled place search, sending search text, language and connection data. Production permission, operator role, locations and transfer position must be confirmed or the integration replaced with a contracted service.
Cloudflare, Sites, Gmail and Resend
The website uses Sites and Cloudflare Workers. Cloudflare Email Routing is enabled for zusio.app and an active catch-all rule forwards support@zusio.app to the operators’ verified Gmail mailbox. The current Cloudflare DPA is archived. Resend has verified mail.zusio.app, and its DPA, which becomes effective when the account is opened, is archived. A mail worker is prepared for automated DSA acknowledgements, decisions and inactivity notices. A sending-only key restricted to mail.zusio.app and the verified sender are stored as encrypted Supabase secrets; worker deployment remains open. Access, retention and subprocessor changes are maintained in the provider register.
Document checksum (SHA-256): 784e4b001f4ea18a81e73df26e9e844c97699bec14b45f17993a47db0b965f6b
This document version · Contact and help · Report content or complain