Sub-Processor List
Last updated: March 7, 2026
In accordance with GDPR and our commitment to transparency, this page lists the sub-processors that deariary uses to provide the service. These third-party providers process user data on our behalf.
Current Sub-Processors
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Google Cloud Platform | Hosting and infrastructure | All service data (encrypted at rest and in transit) | US |
| Stripe | Payment processing | Email address, payment method | US |
| OpenAI | Diary generation (LLM) | Normalized activity data (not retained, not used for training) | US |
| Anthropic | Diary generation (LLM) | Normalized activity data (not retained, not used for training) | US |
| Google (Gemini API) | Diary generation (LLM) | Normalized activity data (not retained, not used for training) | US |
| Vercel | Frontend hosting and CDN | IP address, access logs (anonymized) | US |
| Sentry | Error tracking and monitoring | Error context, request metadata, stack traces | US |
| Resend | Transactional email delivery | Email address, email content | US |
Data Processing Details
Google Cloud Platform
- Services used: Cloud Run, Cloud SQL, Cloud Storage, Pub/Sub, Secret Manager, Cloud Trace, Cloud Monitoring
- Data processed: Account information, diary entries, integration data, ETL pipeline messages, request traces, application metrics
- Encryption: AES-256 at rest, TLS 1.3 in transit
- DPA: Included in Google Cloud Terms of Service
Stripe
- Services used: Payments, Subscriptions, Billing Portal
- Data processed: Email address, payment card details (handled directly by Stripe, not stored by deariary)
- Compliance: PCI DSS Level 1 certified
- DPA: Included in Stripe Terms of Service
OpenAI
- Services used: Chat Completions API
- Data processed: Normalized activity data from connected services, sent for diary generation
- Data retention: Not retained by OpenAI after processing. Not used for model training per our DPA
- DPA: Signed
Anthropic
- Services used: Messages API
- Data processed: Normalized activity data from connected services, sent for diary generation
- Data retention: Not retained by Anthropic after processing. Not used for model training per our DPA
- DPA: Signed
Google (Gemini API)
- Services used: Gemini API (generateContent)
- Data processed: Normalized activity data from connected services, sent for diary generation
- Data retention: Not retained after processing when using the paid API. Not used for model training
- DPA: Included in Google Cloud Terms of Service
Vercel
- Services used: Edge Network, Serverless Functions, Web Analytics
- Data processed: IP address (anonymized), page views, performance metrics
- Scope: Landing page (deariary.com) and frontend application (app.deariary.com)
- Data retention: Analytics data is aggregated and anonymized; no personal data is stored
- DPA: Included in Vercel Terms of Service
Sentry
- Services used: Error tracking, performance monitoring
- Data processed: Error stack traces, request metadata (URL, headers), user context (anonymized user ID), environment info
- Data retention: 90 days by default. No raw personal data is intentionally sent; error context may incidentally include request-level data
- DPA: Signed
Resend
- Services used: Transactional email API
- Data processed: Email address, email content (account notifications, weekly summaries, service updates)
- DPA: Signed
Changes to Sub-Processors
We will update this page when sub-processors are added or removed. If you have subscribed to notifications, we will inform you of changes via email with reasonable advance notice before a new sub-processor begins processing your data.
To subscribe to sub-processor change notifications, contact us at:
Email: support@deariary.com