Data Processing Agreement (Summary)
TraciaAI — Operated by Hubster S.M.N LTD
Effective Date: June 22, 2026
1. Overview
This document summarizes how Hubster S.M.N LTD engages third-party data processors in accordance with GDPR Article 28. A full DPA is available upon request.
2. Sub-Processors
TraciaAI uses the following sub-processors:
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Google (Gemini API) | AI coaching, meal/workout parsing, photo analysis | Chat messages, user context, meal & progress photos (temporary) | USA |
| Cloudflare R2 | File storage | Meal photos, profile pics | Global (EU available) |
| Railway | Backend hosting | All app data | USA/EU |
| Expo | Push notifications | Push tokens, notification content | USA |
| Google AdMob | Advertising (free users) | Device identifiers | USA |
| Apple/Google | Payment processing | Subscription status | USA |
| RevenueCat | Subscription management | Anonymous user ID, subscription transaction data | USA |
| Resend | Transactional and promotional email | Email address | EU (Ireland) |
Note on advertising: Google AdMob is listed above for completeness, but for the device advertising identifiers it collects it acts as an independent advertising provider and an independent controller under its own privacy policy, not solely on Hubster's instructions. We do not share health, nutrition, weight, body, or AI-chat data with AdMob. See our Cookie Policy for how advertising and consent are handled.
3. Safeguards
For all sub-processors located outside the EEA, we ensure:
- Standard Contractual Clauses (SCCs) are in place where required
- Data processing agreements are signed with each processor
- Processors maintain appropriate technical and organizational security measures
- Data minimization principles are followed — only necessary data is shared
4. Data Processing Principles
All sub-processors are contractually required to:
- Process personal data only on documented instructions from TraciaAI
- Ensure that persons authorized to process personal data have committed themselves to confidentiality
- Implement appropriate technical and organizational security measures
- Assist TraciaAI in responding to data subject requests
- Delete or return all personal data upon termination of the service agreement
- Make available all information necessary to demonstrate compliance with GDPR obligations
5. Sub-Processor Changes
We will notify you of any intended changes to the list of sub-processors by updating this document and notifying users through the App. You will have the opportunity to object to such changes. If you object and we cannot reasonably accommodate your objection, you may terminate your account.
6. Your Rights
You may request a full copy of our Data Processing Agreement and the list of current sub-processors by contacting us at hey@hubst3r.com.
7. Contact
Hubster S.M.N LTD
Email: hey@hubst3r.com
Country: Cyprus