Under GDPR Art. 28, this page lists the sub-processors and infrastructure providers that process personal data on behalf of CoThrive (controller: Luca Benjamin Stoll) when you use the CoThrive app or website. It complements the Privacy Policy and does not replace it.
Independent controllers such as Apple and Google (for Sign in with Apple, Google Sign-In, App Store / Play purchases, and platform push delivery) are described in the Privacy Policy and are not listed here as CoThrive sub-processors.
1. Current sub-processors
Each provider below processes personal data only as needed for the stated purpose. Locations reflect primary processing regions disclosed by the provider; support access or backups can involve additional regions. Transfer safeguards are described in Privacy Policy Section 6.
- Google Firebase (Google LLC / Google Ireland Limited) — United States / EU
- Purpose: authentication, database, file storage, backend functions, push messaging, analytics, crash reporting, performance monitoring, remote configuration, and app integrity.
- Data categories: account identifiers, profile and content you store in CoThrive, device and network metadata, diagnostics, and product events as described in the Privacy Policy.
- PostHog (PostHog Inc., EU Cloud) — European Union (Frankfurt ingestion)
- Purpose: product analytics for the mobile app.
- Data categories: installation or user identifiers, app and device information, lifecycle and feature events, and related event properties.
- Singular Labs, Inc. — United States
- Purpose: referral-link handling, deep-link attribution, and related fraud or delivery diagnostics where the integration is configured.
- Data categories: link and campaign parameters, IP/network and device information, app events, and advertising or device identifiers made available by the platform.
- RevenueCat, Inc. — United States
- Purpose: subscription entitlement management, restore purchases, and referral-reward entitlements.
- Data categories: app-user identifiers, store receipt and transaction references, product and entitlement state, promotional periods, and technical diagnostics.
- Vercel Inc. — United States / global edge
- Purpose: website hosting, delivery, security, Web Analytics, and Speed Insights.
- Data categories: request logs (IP address, URL, status, referrer, user agent), aggregate analytics hashes, Core Web Vitals, and categorical custom events. Contact-form field contents are not attached to analytics events.
- EmailJS Pte. Ltd. — Singapore
- Purpose: delivery of validated website contact-form messages.
- Data categories: submitted contact fields (name, email, subject, message) and delivery metadata.
2. Changes to this list
We will update this page when we engage a new sub-processor for personal data or stop using one. Material changes that affect how existing personal data is processed are also reflected in the Privacy Policy where required.
Questions about this list: info@cothriveapp.com.
3. Data Processing Agreement (DPA)
If you are a business customer or other organization that needs CoThrive to process personal data on your behalf as a processor, you may request a Data Processing Agreement under GDPR Art. 28.
To request a DPA, email info@cothriveapp.com with subject line “DPA request”, your organization name, contact person, and a short description of the processing relationship. We will respond with the applicable DPA terms or clarify whether CoThrive acts as controller or processor for the use case you describe.
The Privacy Policy remains the notice for end users of the CoThrive consumer app and website. A signed DPA, where applicable, governs the processor relationship with the requesting organization.