TraitMatch Subprocessors
Version 1.8 — Effective 5 November 2026
We use carefully selected service providers (“processors”) to operate TraitMatch. They process personal data only on our instructions and under data processing terms. This list is for transparency (GDPR Art. 28 / 13(1)(e)); it may not list every transient subprocessors used by a primary provider.
1. Application API, edge, CDN, and media storage
• Cloudflare, Inc. — reverse proxy, TLS termination, DDoS protection, CDN, Cloudflare Pages (marketing site), R2 object storage for profile/chat media, optional Cloudflare Access for staff-only tools
• Role: deliver API and website; store and serve user-uploaded media; security at the edge
• Typical data: IP addresses, request metadata, media objects, static assets
• Transfers: global network; EU SCCs / DPA as applicable
2. Database and backend hosting
• Supabase / managed PostgreSQL (or equivalent managed Postgres provider configured for our project)
• Role: primary application database (accounts, profiles, matching, chat metadata, economy, safety, privacy audit logs, notifications)
• Typical data: account and profile fields, activity metadata, ciphertext and chat metadata, wallet/ledger rows
• Transfers: depends on project region; we prefer EU regions where configured
3. Authentication, identity, and push notifications
• Google LLC — Firebase Authentication (e.g. Google Sign-In, email/password identity verification) and Firebase Cloud Messaging (push delivery)
• Apple Inc. — Sign in with Apple (when you use it); Apple Push Notification service may apply on iOS alongside FCM integration patterns
• Role: verify identity tokens; deliver push notifications you enable
• Transfers: may involve US processing under provider DPAs and SCCs
4. App distribution and in-app payments
• Google Play (Google LLC) — Android distribution and billing for subscriptions / consumables
• Apple App Store (Apple Inc.) — iOS distribution and billing for subscriptions / consumables
• Role: store distribution; payment processing (we receive purchase tokens / entitlements, not full card numbers)
5. Email and SMS (when enabled)
• Transactional email and SMS providers used for account security, verification, and support — named in an updated list when live in production (e.g. OTP or support desk routing)
6. Analytics, crash reporting, and advertising (future)
• Not currently shipped in the production consumer app. If added, providers will be listed here before or when enabled, and optional SDKs will require consent where required by law.
7. Internal operations
• Authorised TraitMatch staff and contracted developers/support under confidentiality — access production systems only as needed for operation, security, moderation, and compliance (not a separate “processor” in all jurisdictions, but disclosed for transparency).
Updates
We update this list when processors change materially. Last updated version appears above. Questions or processor due diligence requests: [email protected].
Related: Privacy Policy https://traitmatch.pages.dev/privacy · Cookie Policy https://traitmatch.pages.dev/cookies
