Version 2.5 · effective 2026-10-11
Subprocessors and Providers — FizzUp
1. How to read this registry
FizzUp uses technology providers only to the extent required for an active function. Not every technically approved integration is active for every user, market or module.
The public registry distinguishes active providers from providers only approved for possible activation. A provider marked optional does not receive data merely because it appears in this registry. Before activation, FizzUp confirms the exact legal entity, role, processing region, contract/DPA and transfer basis and, where the provider will be a subprocessor of Entrusted Data, follows the DPA notice procedure.
2. Registry
| Provider / group | Function | Typical data | Functional status | Safeguards |
|---|---|---|---|---|
| Railway | API, database, website and backend infrastructure hosting | account data, progress, transcripts, coach memory, beta list, logs | active; EU region (the Netherlands, europe-west4) | contract and DPA |
| Google Cloud / Google Gemini | the only active AI provider: live voice conversation (Gemini Live, relayed through the FizzUp server, audio not stored), coach replies in chat, post-session analysis and learning plan, coach memory (including embeddings), pronunciation assessment in exercises, speech recognition and synthesis (Google Cloud Speech-to-Text and Text-to-Speech); also Google sign-in and notifications (Firebase Cloud Messaging) | Live audio, chat text and transcripts, learning profile and goals, coach memory, exercise recording, device token, email and Google identifier for sign-in | active, key | DPA and an appropriate transfer mechanism, e.g. adequacy/DPF or SCCs |
| Hostinger | transactional email (sign-in, invitations, notifications, billing) and marketing email (only with the recipient's prior consent) through its mail server (SMTP); FizzUp mailboxes (e.g. hello@, privacy@, support@) and domain | email address, name, message content, delivery data, correspondence sent to and from FizzUp | active | contract/DPA; region and transfer in line with the service configuration |
| Resend | alternative email delivery, if activated | email address, name, message content, delivery data | optional | activation only after confirming contract/DPA, region and transfer mechanism |
| Stripe | web payments, B2B billing and future web B2C/Family billing | customer ID, transaction and billing data; card data handled by Stripe under its service | active for web billing | DPA/payment terms and appropriate transfer mechanism |
| Apple | iOS distribution, Sign in with Apple, push and consumer purchases if activated | account/device identifiers, purchases, platform data | active depending on platform | platform terms and applicable safeguards |
| Google Play / Google Identity | Android distribution, authentication and consumer purchases if activated | account/device identifiers, purchases, platform data | active depending on platform | platform terms and applicable safeguards |
| Microsoft (Azure Speech) | pronunciation assessment in selected exercises, if activated (pronunciation is currently assessed by Google Gemini) | recording of the answer in the exercise and its text | optional, inactive | activation only after confirming contract/DPA, region and transfer mechanism |
| Meta (WhatsApp Business) | WhatsApp messages with FizzUp, if the user uses this channel | phone number and message content | optional | activation only after confirming contract/DPA and transfer mechanism |
| Sentry | error/stability diagnostics if activated | technical data, event identifiers, redacted error context | optional | before activation: confirm entity, DPA, content minimisation and transfer mechanism |
| OpenAI | premium voice conversation and additional language models, if activated | Live audio, text, transcript and session identifier needed for the feature | optional, inactive (receives no data) | activation only after updating the pre-voice notice and confirming contract/DPA, training restrictions and transfer mechanism |
| Anthropic | additional language models if activated | text and context needed for the function | optional, inactive (receives no data) | before activation: contract/DPA, no-training setting, transfer mechanism |
| OpenRouter | routing to additional models (e.g. Anthropic) if activated | text and limited function context | optional, inactive (receives no data) | activation only after privacy, security, contract and transfer review |
| z.ai | additional language model if activated | text and limited function context | optional, inactive (receives no data) | activation only after privacy, security, contract and transfer review |
| Twilio | SMS and one-time codes, if activated | phone number, code content | optional, inactive | activation only after privacy, security, contract and transfer review |
3. No-training principle
For Private Coaching Layer data, FizzUp uses service configurations and terms that, under the relevant contract and provider capabilities, exclude use of transferred data for training the provider's general/public models.
4. Provider changes
FizzUp may change a provider or model for quality, availability, security, compliance or cost reasons. A change requiring notice or objection under the DPA is communicated to the B2B customer within the specified notice period.
Material public-registry changes are reflected in the Legal Centre.
5. Transfers
Where processing occurs outside the EEA, we use an appropriate GDPR transfer mechanism, including an adequacy decision, the EU-US Data Privacy Framework for an eligible recipient, or SCCs together with a transfer assessment and supplementary measures where required.
Contact: privacy@fizzup.ai.
The Polish version is the reference version. This English text is a translation; in case of an unintended difference, the Polish version prevails.