Subprocessors
Last updated: 1 August 2026
Hirdfit is operated by Gabriel Pająk Rozwiązania Informatyczne. We use a small number of third-party providers to run the service. This page lists the ones that process personal data on our behalf — our subprocessors — and, separately, the third parties that receive data but do not act on our behalf.
Everything here is the same set of facts as the recipients table in our Privacy Policy, restated in the form data-protection reviewers expect.
Subprocessors
| Provider | Purpose | What it processes | Location |
|---|---|---|---|
| Google Ireland Ltd. / Google LLC Firebase, Google Cloud |
Authentication, database, database backups, web hosting | Your account identity and all content you store in Hirdfit | Data stored in Belgium (europe-west1), backups included; company US/IE |
| Anthropic PBC | Generating AI coach replies | Only when you use the AI coach: your chat messages and the training data the coach looks up to answer them | USA |
| Stripe Payments Europe Ltd. | Taking payment for coach credits bought on the website (purchases in the Android app go through Google Play instead — see below) | Your Hirdfit user id, the package and the amount. Your card details and the email you give Stripe are collected by Stripe directly and never pass through our servers | Ireland, with onward transfer to the USA |
| OVH SAS | Hosting our API server | Data in transit through the API | France |
| Raintank Inc. dba Grafana Labs Grafana Cloud |
Monitoring and alerting on the API | Server logs and operational metrics: routes, status codes, latency, errors and security events. No IP addresses and no query strings. Your user id on payment and account-security events. No training, measurement or coach-conversation data | Data stored in the EU region; company US |
Transfers outside the EU
Your data is stored in the European Union. Where a subprocessor above is outside it, the transfer relies on the European Commission's Standard Contractual Clauses, and on the EU–US Data Privacy Framework where the recipient is certified. Each of these providers has a data processing agreement with us that incorporates those clauses.
Third parties that are not subprocessors
These also receive data, but not on our behalf — so they are not subprocessors. We list them because you should know about them either way.
| Party | What happens |
|---|---|
| Hevy, Strava | Sources, not recipients. If you connect them, we read your data from them using a credential you supplied. No Hirdfit data is sent to either. |
| HeiGIT gGmbH OpenRouteService |
Receives the start coordinate of a route you are planning and any address text you type, with no account identifier attached. It stores nothing for us. Germany. |
| MapTiler AG | Receives the coordinates of the map area on screen, with no account identifier and no IP address: our API requests the tiles on your behalf, so MapTiler sees our server and not your device. It stores nothing for us. Switzerland. Map data is © OpenStreetMap contributors. |
| Google Play in-app purchases on Android |
If you buy credits inside the Android app, Google Play is the seller, not us. Google takes the payment under its own terms and privacy policy and decides for itself what to do with your payment data, so it is acting as its own controller here rather than on our behalf. We send Google a one-way scrambled form of your Hirdfit user id so the purchase can be matched back to your account, and we ask Google to confirm the purchase. We never see your payment details, and we cannot see what you were charged. (Google is separately our subprocessor for Firebase — a different relationship, listed above.) Ireland / USA. |
| An AI assistant you connect yourself | If you enable AI access and connect an assistant such as Claude, it reads your data under your own agreement with that provider — you choose it and you direct it. It is not acting on our behalf, so it is not our subprocessor. |
What we do not send to AI providers
Two limits are worth stating plainly, because they are choices rather than accidents:
- Strava-sourced workouts are excluded from all AI features. Strava's API terms restrict passing its data to AI models, so activities imported from Strava are withheld from the AI coach and from any assistant you connect. They remain fully visible to you inside the app. If a session was recorded to both Strava and your phone's health store, the coach sees your phone's copy.
- Your email address, account identifier, IP address and saved routes are never sent to an AI provider — only training and measurement data, and what you type into the chat.
Changes
If we add or replace a subprocessor we will update this page and, where the change is material, tell you in the app before it takes effect. Questions: privacy@hirdfit.com.