Sub-Processor List

Last updated: April 2026

To support the delivery of FriendRex and provide a secure, scalable experience, we engage third-party service providers (sub-processors) to process personal data on our behalf. We maintain strict data processing agreements (DPAs) with each provider to ensure your data is handled securely and in compliance with global privacy laws, including the GDPR and CCPA.

Below is the current list of authorized sub-processors:

Sub-processor Service Data processed Region Agreement
Google LLC (Firebase) Auth, Firestore, Storage, FCM, Cloud Functions, Cloud Run, BigQuery Account data, content, device IDs, usage events US (multi-region) Firebase DPA
Google LLC (Gemini API) LLM inference for free-tier Rex Prompt + last 20 turns of conversation US Google AI DPA
OpenAI, Inc. LLM inference for Pro-tier Rex (gpt-4o-mini) and Gold (gpt-4o) Prompt + last 20 turns US OpenAI Enterprise DPA
Anthropic, PBC LLM inference fallback (if routed) Prompt + last 20 turns US Anthropic Commercial DPA
Stripe, Inc. Payment processing Email, billing address, payment method (tokenized), transaction amount US Stripe DPA
TMDB (The Movie Database) Movie/TV metadata Non-PII query strings only (movie titles / ids); no user data forwarded US Public API terms
Netlify, Inc. Web SPA hosting + CDN Request metadata (IP, user-agent) US (multi-region) Netlify DPA
Apple Inc. IAP + Sign in with Apple + APNs Purchase receipts, auth tokens, device tokens US Apple Developer Agreement
Google LLC (Play) IAP + FCM delivery Purchase receipts, device tokens US Play Developer Distribution Agreement
NCMEC / Google Cloud Vision CSAM reporting / Content moderation Image hashes + classification results US Per-vendor agreements

Subscribe to Updates

We will notify users of any material changes to our sub-processor list via our Privacy Policy Changelog and via email for material data processing changes. Enterprise users or those requesting proactive updates may contact us at sub-processor-updates@friendrex.app.