Subprocessors

Last Updated:: July 18, 2026
Effective Date:: July 18, 2026

Subprocessor List

Last Updated: July 18, 2026 Effective Date: July 18, 2026

This Subprocessor List identifies the third-party service providers (each, a "Subprocessor") that My Opus, Inc. ("Opus," "Company," "we," "us," or "our") engages to process personal information in connection with the Opus services (the "Services"). This Subprocessor List supplements, and forms part of, our Privacy Policy. Capitalized terms used but not defined in this Subprocessor List have the meanings given to them in our Terms of Use or our Privacy Policy, as applicable.

1. About This Subprocessor List

A "Subprocessor" is a third-party service provider that we engage to process personal information on our behalf. We engage Subprocessors only where necessary to provide and operate the Services and only under written contracts that require the Subprocessor to:

(a) process personal information solely for the purposes for which we engage the Subprocessor and in accordance with our instructions;

(b) implement and maintain appropriate technical and organizational security measures;

(d) comply with applicable data protection and privacy laws.

The Subprocessors listed below are categorized by the function each performs. We refer in this Subprocessor List to "Personal Information" with the meaning set forth in our Privacy Policy. Specific categories of Personal Information shared with each Subprocessor depend on the function performed.

We update this Subprocessor List from time to time as we add, change, or remove Subprocessors. By referring to this Subprocessor List rather than maintaining a list of specific Subprocessors within our Privacy Policy, we are able to update our Subprocessor relationships in response to operational needs without requiring an amendment to our Privacy Policy. The categories of Subprocessors are described in Section 6.1 (Service Providers and Subprocessors) of our Privacy Policy and remain consistent across changes to specific Subprocessors.

2. Current Subprocessors

The following table identifies our current Subprocessors as of the Effective Date.

2.1 Cloud Infrastructure, Database, and Storage

Subprocessor	Function	Location of Processing	Privacy Information
Supabase, Inc.	Database, authentication, file storage	United States	https://supabase.com/privacy
Vercel Inc.	Web application and marketing site hosting	United States; global edge network	https://vercel.com/legal/privacy-policy

2.2 Artificial Intelligence and Machine Learning

Subprocessor	Function	Location of Processing	Privacy Information
Anthropic, PBC	Large language model processing for Outputs and personalization	United States	https://www.anthropic.com/legal/privacy
OpenAI, L.L.C.	Text embedding generation for memory and retrieval	United States	https://openai.com/policies/privacy-policy

2.3 Mobile Application Distribution and Build Services

Subprocessor	Function	Location of Processing	Privacy Information
650 Industries, Inc. (Expo / EAS)	Mobile application build, distribution, and over-the-air updates	United States	https://expo.dev/privacy

2.4 Push Notification, Messaging, and Communications

Subprocessor	Function	Location of Processing	Privacy Information
650 Industries, Inc. (Expo Push)	Mobile push notification delivery	United States	https://expo.dev/privacy
Apple Inc. (Apple Push Notification service)	iOS push notification delivery	United States; global	https://www.apple.com/legal/privacy/
Google LLC (Firebase Cloud Messaging)	Android and web push notification delivery	United States; global	https://policies.google.com/privacy

2.5 Analytics and Product Telemetry

Subprocessor	Function	Location of Processing	Privacy Information
PostHog, Inc.	Product analytics, feature usage measurement, session analytics	United States; European Union (configurable)	https://posthog.com/privacy

2.6 Error Monitoring and Performance

Subprocessor	Function	Location of Processing	Privacy Information
Functional Software, Inc. (Sentry)	Error tracking, crash reporting, performance monitoring	United States	https://sentry.io/privacy/

2.7 Customer Support

As of the Effective Date, we have not engaged a dedicated customer support subprocessor. If and when we engage one, we will update this Subprocessor List in accordance with Section 3 (Notice of Changes to Subprocessors).

2.8 Payment Processing

[Currently inactive. Activate when paid features are launched.]

Subprocessor	Function	Location of Processing	Privacy Information
Apple Inc. (App Store In-App Purchase)	Payment processing for iOS in-app purchases	United States; global	https://www.apple.com/legal/privacy/
Google LLC (Google Play Billing)	Payment processing for Android in-app purchases	United States; global	https://policies.google.com/privacy
Stripe, Inc.	Payment processing for web purchases (when offered)	United States; global	https://stripe.com/privacy

2.9 Authentication and Identity

Subprocessor	Function	Location of Processing	Privacy Information
Supabase, Inc.	First-party email and password authentication	United States	https://supabase.com/privacy
Apple Inc. (Sign in with Apple)	Optional third-party authentication, when used by you	United States; global	https://www.apple.com/legal/privacy/
Google LLC (Sign in with Google)	Optional third-party authentication, when used by you	United States; global	https://policies.google.com/privacy

Subprocessor	Function	Location of Processing	Privacy Information
Silktide Ltd.	Cookie consent management platform	United Kingdom	https://silktide.com/legal/privacy-policy/

2.11 Productivity, Collaboration, and Internal Tooling

We use a variety of productivity, collaboration, and internal tooling services (such as source code hosting, project management, internal documentation, and team communications) in the operation of our business. These tools are used for internal business purposes such as engineering, product management, and team collaboration, and are not used to provide the Services to Users. As of the Effective Date, these tools do not access User Content or User account information through the ordinary course of their use, and access to User data through internal tooling is limited to authorized personnel acting through approved internal systems (such as a closed administrative dashboard) in accordance with our Privacy Policy.

Where, in connection with troubleshooting, support, or quality assurance, an authorized member of our personnel determines it necessary to share specific User information through an internal collaboration channel (such as in a support ticket or in a brief team chat), such sharing is performed in accordance with our internal information security and access control practices. The internal tools used for such sharing are not engaged as Subprocessors of User personal information for purposes of this Subprocessor List, but we will reassess this position if our use of internal tooling materially expands the categories of User personal information processed in such tools.

2.12 Other Subprocessors

We engage outside legal counsel, accountants, auditors, and other professional advisors in connection with our business. These advisors do not, in the ordinary course of their engagement, process Personal Information of Users. In the event that an advisor is required to process Personal Information of Users in connection with a specific matter (for example, in the course of investigating a Security Incident, responding to legal process, or in connection with a corporate transaction), such processing will be subject to professional confidentiality obligations and (where applicable) a specific written engagement.

We reserve this Section 2.12 to ensure transparency regarding any other Subprocessors that may be engaged from time to time and that do not fit cleanly into the categories above. We will update this section as additional engagements occur.

3. Notice of Changes to Subprocessors

We update this Subprocessor List when we add, change, or remove Subprocessors. We may make non-material updates (such as correcting a Subprocessor's address or updating a privacy policy URL) without separate notice.

For material updates that affect categories of Personal Information shared with new Subprocessors, we will provide notice through the Services or by other reasonable means, in accordance with our Privacy Policy. To request notification of changes to this Subprocessor List, please contact us at privacy@opuswithin.com.

4. International Data Transfers

A number of our Subprocessors are located in, or process Personal Information in, the United States. As described in Section 12 (International Data Transfers) of our Privacy Policy, we rely on appropriate safeguards for transfers of Personal Information from jurisdictions that have not been deemed by the relevant authorities to provide an adequate level of protection.

For Personal Information transferred from the European Economic Area, the United Kingdom, or Switzerland to Subprocessors located in third countries, we generally rely on the European Commission's Standard Contractual Clauses (and the UK Addendum thereto, where applicable). Where a Subprocessor has self-certified to the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, or the Swiss-U.S. Data Privacy Framework, we may also rely on those mechanisms. Information about a Subprocessor's specific transfer mechanisms is available on request.

5. Contact Us

For questions about this Subprocessor List, please contact us at:

My Opus, Inc. Attention: Privacy Email: privacy@opuswithin.com General Legal: legal@opuswithin.com