List of Sub-processors and Providers Relevant to Data
Final version V1 · August 7, 2026 · CG INVESTORHOOD ENTERPRISE S.R.L. Page published on: https://www.investorhood.com/
This list describes the confirmed providers for the Investorhood V1 app that may process personal data or may act as independent controllers for a requested function.
Active Providers
| Provider | Service / purpose | Location / transfer | Relevant data | Role |
|---|---|---|---|---|
| Supabase | Backend, authentication, database, server-side functions | V1 project: West Europe (London), eu-west-2, United Kingdom. The United Kingdom benefits from an EU adequacy decision as of the date of this version. | account data, questionnaire, favorites, Watch History, Hoody conversations/messages, relevant tokens/metadata | processor / infrastructure provider |
| Google – Gemini API (Paid Services) | Hoody AI text-to-text | Google Ireland Limited / Google LLC; transfers are governed by the applicable terms/DPA and mechanisms | prompts, responses, and the context required for generation | processor for Paid Services, under the Google terms |
| Google / YouTube | Embedded video playback | EEA/USA and other locations according to Google's infrastructure | technical/device/network data required for playback; in-player activity under the Google/YouTube policies | may act independently for the YouTube service |
| Expo / Apple APNs / Google FCM | Notifications and push infrastructure | according to each provider's infrastructure | notification token, platform, technical metadata | technical providers / independent controllers, as applicable |
| Google Workspace / email provider | Operational and support email | according to the Google Workspace configuration | email, name, content of the communication | communications provider |
| WhatsApp / Meta | User-chosen support channel | according to Meta's infrastructure | phone number/WhatsApp profile and the content of the conversation | primarily an independent controller for the WhatsApp service |
Providers NOT Declared Active in V1
The following are not declared as active V1 processing:
- Firebase Analytics;
- Crashlytics;
- advertising/tracking providers;
- App Store/Google Play payment processors for IAP;
- broker sync providers;
- community/UGC platforms.
Notes on Google Gemini
For Paid Services, the Google terms provide that prompts and responses are not used to improve Google's products and are processed under the applicable Data Processing Addendum.
Google may retain prompts/responses on a limited basis for abuse detection and legal obligations, in accordance with the terms in force.
The exact Gemini model is not published in this list because it is a technical configuration that may be changed without altering the purpose of the processing.
Notes on Supabase
The project region has been verified in the Supabase Dashboard as West Europe (London), eu-west-2.
The United Kingdom is covered by the EU adequacy decision in force as of the date of this document.
Contact
For questions regarding the providers or your data rights: privacy@investorhood.com.
