Back to home
Legal

Sub-processors

Every provider that touches your data on our behalf, what it does, and where it is established.

Last updated: 2 September 2026

Who processes data on our behalf

MIBEVA LTD is the data controller for Peakfy. The providers below process personal data on our instructions and strictly to run the service. We conclude a data-processing agreement under Article 28 GDPR with each processor we use, and keep that under review. We do not sell your data, and none of these providers may use it for their own purposes.

  • Supabase — database, authentication and file storage.
    Data processed: account data, profile data, training and health data. Hosted in the European Union (eu-central-1).
  • Anthropic — generates the AI coach's replies.
    Data processed: the training context needed for a reply, after direct identifiers such as your name and email address have been removed. Provider established in the United States; transfer safeguards as described in the Privacy Policy, Section 9.
  • Resend — delivers one internal notification email to our own support address when someone reports a comment in the app.
    Data processed: no user content at all — the message carries only a reason code from a fixed list and an internal identifier. The reported text itself is deliberately left out, and no name, email address or health data is included. Nothing about you as a person is processed here. Provider established in the United States.
  • Netlify — hosting for the getpeakfy.com website only.
    Data processed: standard server log data (IP address, time, page requested, browser type). No account or health data. Provider established in the United States.

When paid subscriptions are introduced, the app stores and the subscription provider involved will be added here before they begin processing data. The provider we intend to use is RevenueCat. It is not built in and not active: no subscription data is processed anywhere today.

Platforms you connect yourself

The services below are not our sub-processors. They are independent third parties that you choose to connect, each with its own terms and privacy policy. Data flows to or from them only after you authorise it, and only as described in the Privacy Policy, Section 3(c).

  • Apple Health (HealthKit) — read on your device, with your permission.
  • WHOOP — recovery data only. Peakfy reads no rides, workouts or power from WHOOP.
  • Polar (Polar AccessLink, part of the Polar Ecosystem) — recovery data only. Peakfy reads no rides or workouts from Polar.
  • Intervals.icu — recovery data and rides.
  • Strava — write-only. Peakfy can write your completed training to Strava and reads nothing from it.

Connections to Wahoo, COROS and Suunto are built but not yet available; each still requires that provider's approval, and until it is granted no data flows to or from them. Peakfy has no connection to Garmin, and is not connected to any platform beyond those named above.

Changes to this list

We keep this page up to date. If we add a new sub-processor, we update this page before it starts processing your data. If you would like to be told when this list changes, write to support@peakfy.app and we will let you know.

← Back to home  ·  Privacy Policy  ·  Security  ·  Delete your account  ·  Terms of Service  ·  Legal Notice