Extrais — Sub-processors
1. What this page is
TABA Tasarım İnşaat Anonim Şirketi ("TABA", "we", "us"), the company that operates Extrais, is the data controller for personal data processed through the App. To run the Service we rely on a small number of trusted providers that act as our processors (sub-processors). Each of them processes personal data only on TABA's documented instructions, under a written data-processing agreement (DPA) that requires appropriate security, confidentiality, and data-protection safeguards. They may not use your data for their own purposes.
2. Our sub-processors
The table below lists the sub-processors we currently use, what each does, and where it processes data or the safeguard relied on for any international transfer.
| Sub-processor | Purpose | Location / transfer safeguard |
|---|---|---|
| Supabase | Core data processor — Postgres database, authentication, realtime messaging, and file storage. Holds the primary application data. | Hosted in the EU. Core data is kept in the EU. |
| Apple Push Notification service (APNs) | Delivery of push notifications to iOS devices. | Operated by Apple. International transfers rely on EU Standard Contractual Clauses (SCCs) or adequacy where applicable. |
| Google Firebase Cloud Messaging (FCM) | Delivery of push notifications to Android devices. | Operated by Google. International transfers rely on EU Standard Contractual Clauses (SCCs) or adequacy where applicable. |
| Resend | Transactional email — one-time login codes (OTP) and account-related email. | International transfers rely on EU Standard Contractual Clauses (SCCs) or adequacy where applicable. |
| Brevo | Optional newsletters and marketing email. Used only where you have given consent. | EU-based provider. International transfers rely on EU Standard Contractual Clauses (SCCs) or adequacy where applicable. |
| Google / Firebase Analytics + Crashlytics | Product analytics and crash reporting to improve stability and the App. Off by default — runs only after you opt in to analytics. | Operated by Google. International transfers rely on EU Standard Contractual Clauses (SCCs) or adequacy where applicable. |
| Hetzner Online GmbH | Hosts Extrais's self-managed servers — over-the-air update delivery, push dispatch, and the website. | Germany (EU). |
3. Consent-gated providers
The analytics and crash-reporting vendor (Google / Firebase Analytics + Crashlytics) is disabled by default. It processes data only after you opt in to analytics in the App, and you can withdraw that consent at any time. Newsletter email (Brevo) is likewise used only where you have given consent and can be unsubscribed at any time. How consent works is described in our Privacy Policy and Cookie Policy.
4. App stores & in-app purchases
When you buy digital credits, Apple (App Store) and Google (Google Play) process your in-app-purchase data under their own terms as independent controllers of that payment data. TABA never receives your full payment-card details. This is separate from the sub-processor relationships listed above.
5. International transfers
Our core data is hosted in the EU. Where a sub-processor processes personal data outside the European Economic Area, we rely on a lawful transfer mechanism — EU Standard Contractual Clauses (SCCs) or an adequacy decision where applicable — together with appropriate technical and organisational safeguards. More detail is in our Privacy Policy.
6. Changes to this list
We keep this list current. As Extrais grows we may add, replace, or remove sub-processors. When we do, we will update this page and revise the "Last updated" date above; for changes that materially affect how your personal data is processed, we will provide notice as required by law. We encourage you to check this page periodically.
7. Questions
If you have any question about our sub-processors or how your personal data is handled, contact us at info@vitamedas.com. You can exercise your data-protection rights — including access, correction, deletion, and objection — as described in our Privacy Policy.
8. Related documents
See also our Terms of Service, Privacy Policy, Cookie Policy, and Acceptable Use Policy.