Subprocessors
About this translation. This page is an English translation of maru's Japanese Subprocessors list, provided for reference. The Japanese Subprocessors list is the governing document; in the event of any discrepancy between the two, the Japanese version controls. The Japanese source is also still in draft form pending final legal review, so this translation may change without notice as that review concludes.
maru Subprocessors (List of External Data Processors) v1
0. Purpose of This Page
- The body of our Privacy Policy describes only the major overseas providers in general terms; details are disclosed on this page.
- We update this page whenever we add a subprocessor or make a change, and we notify existing users within 30 days after the change, through an in-app display and a posting on this page. We do not promise to send individual messages to your registered email address.
- We transfer personal data to the subprocessors listed on this page on the basis set out in Privacy Policy §6 (your consent under §7, together with the information provided under Article 17 of the Enforcement Rules; where special-care personal information is involved, your explicit consent).
1. List of Subprocessors
1.1 AI-Related
| Provider | Country | Role | Data Categories | Privacy Policy |
|---|---|---|---|---|
| Anthropic, PBC | United States | AI chat response generation (Claude API) | Chat input text, health-data summaries | https://www.anthropic.com/legal/privacy |
| OpenAI OpCo, LLC | United States | Meal-photo analysis, AI assistance (GPT API) | Meal photos, chat input text | https://openai.com/policies/privacy-policy |
| Google LLC | United States | Initial meal-photo analysis (Gemini API via Vertex AI) | Meal photos, learned history of food-item names (names learned from past corrections) | https://cloud.google.com/terms/cloud-privacy-notice |
| TypeSafe AI, Inc. (TypeSafe) | United States | Intent classification of meal-entry text (routing to new entry / addition / correction / question, via the Jev API) | The free-text meal entry you type and the result of the most recent photo analysis (may include health information). We do not send the photo itself, your name, or your contact information | https://typesafe.ai/legal/privacy-policy |
1.1.1 Additional Detail on TypeSafe (Training Use and Retention)
| Item | Details |
|---|---|
| Training use | We do not use this for training. TypeSafe's privacy policy states that it will not train or fine-tune AI/ML models on prompts or other input, and its Master Cloud Agreement §4.1 similarly states it will not include customer data in a training dataset without prior consent. |
| Retention | The primary source materials do not state a specific retention period. Zero data retention (ZDR) is an enterprise-only option and is not applied to us by default. We are confirming the retention period with the provider. |
| DPA | Under TypeSafe's Master Cloud Agreement §4.4, the DPA at typesafe.ai/data-processing is incorporated by reference on a click-through, self-serve basis (not limited to enterprise customers). |
1.2 Backend and Data Storage
| Provider | Country | Role | Data Categories | Privacy Policy |
|---|---|---|---|---|
| Supabase, Inc. | United States | Database, Storage, Edge Functions | Account information, all health data, photos | https://supabase.com/privacy |
1.3 Billing
| Provider | Country | Role | Data Categories | Privacy Policy |
|---|---|---|---|---|
| Stripe, Inc. | United States | Payment processing (from Phase 1 onward) | Billing information, card number (held solely by Stripe) | https://stripe.com/privacy |
1.4 Operational Support Services (Behavioral Analytics, Error Monitoring, Web Hosting)
| Provider | Country (Provider's Location) | Role | Data Categories | Privacy Policy |
|---|---|---|---|---|
| PostHog, Inc. | United States | Behavioral analytics (product analytics) | App operation logs; a persistent pseudonymous ID and session ID used for analytics (on the web, the account ID itself is sent). This is not anonymized information (see §1.4.1) | https://posthog.com/privacy |
| Functional Software, Inc. (Sentry) | United States | Error and crash monitoring | Stack traces, device information, app logs | https://sentry.io/privacy/ |
| Vercel Inc. | United States | Hosting of our web properties | Access logs, IP address (with anonymization applied) | https://vercel.com/legal/privacy-policy |
1.4.1 Additional Detail on PostHog (Provider, Storage Location, and Identifiers)
| Item | Details |
|---|---|
| Contracting entity (provider) | PostHog, Inc. (San Francisco, United States) |
| Country of transfer | United States. Under APPI Art. 28, whether a recipient is a "third party located in a foreign country" is determined by the provider's country of location — so even though we have selected an EU data region, the transfer destination is the United States. |
| Data storage location | Germany (Frankfurt). We use PostHog Cloud EU, which runs on AWS's eu-central-1 region. |
| Basis under Art. 28 | As described in the general principle in §2.3 (your consent under Privacy Policy §7, plus the information provided under Enforcement Rule Article 17). We do not rely on the exemption available under an EU adequacy finding, and we do not rely on the "equivalent standard compliance system" under Enforcement Rule Article 16, Item 1. |
Identifiers we send (this is not "anonymous"):
- Mobile app: we send a persistent pseudonymous analytics ID that we issue (the same value across app sessions) and a session ID. We maintain an internal mapping between this pseudonymous ID and the user, so this information is personal information, not anonymized information. We delete that mapping once the basis for behavioral analytics ends (for example, if a future version with an opt-out setting is turned off, if measurement under the Privacy Policy ends, or if the account is deleted).
- Web properties (nagaiki.ai): for post-login behavioral analytics, we send our own account ID (the Supabase user ID) directly as the identifier.
- In neither channel do we send your name, email address, photos, meal content, health values, or chat text.
1.6 Email Delivery
| Provider | Country | Role | Data Categories | Privacy Policy |
|---|---|---|---|---|
| Plus Five Five, Inc. (Resend) | United States | Delivery of notification emails (contact-form notifications, invitation notices, billing-related notices, and notices to our team of feedback submitted through TestFlight) | Email address, display name, contact-form content, the content and device information of feedback submitted through TestFlight, billing dates, and similar dates | https://resend.com/legal/privacy-policy |
2. Overview of Transfer-Destination Countries and Their Data Protection Regimes
2.1 Determining the Transfer-Destination Country
Whether a transfer falls under Article 28 of Japan's Act on the Protection of Personal Information ("a third party located in a foreign country") is determined not by where the data is physically stored, but by the country where the receiving provider is located. Accordingly, even where we select a provider's EU region, if that provider is a U.S. legal entity, the transfer-destination country is the United States.
Every subprocessor listed on this page is a U.S. legal entity.
2.2 United States
There is no comprehensive federal personal-data-protection law; regulation is instead governed by sector-specific laws (such as HIPAA and GLBA) and state laws (such as California's CCPA/CPRA and Virginia's VCDPA). The United States has not been designated by Japan's Personal Information Protection Commission as a country with an equivalent standard of protection.
2.3 Measures We Take (Basis Under Article 28)
Our basis under Article 28 is as follows:
- General principle: your consent under Privacy Policy §7 (APPI Art. 28, para. 1), plus the information provided under Enforcement Rule Article 17
- PostHog (behavioral analytics): the same general principle above — your consent under §7, plus the information provided under Enforcement Rule Article 17. We do not currently rely on the "equivalent standard compliance system" under Enforcement Rule Article 16, Item 1
- Where special-care personal information is involved: for every subprocessor, we obtain your explicit consent in addition to the above
See Privacy Policy §6 for details.
2.4 About Data Storage Location
Separately from the determination of the transfer-destination country (§2.1), we disclose the data storage location as reference information. For PostHog, data is stored in the EU region (Frankfurt, Germany). For Google (Vertex AI), we use the global endpoint, which does not designate a specific region, so we have not identified the region where processing occurs. Under Japan's Act on the Protection of Personal Information, the fact that data is stored within the EEA is not, by itself, grounds for exemption from Article 28 (Japan's designation of the EEA as "a country with a standard equivalent to Japan's" applies where the receiving provider is located in that country, which is not the case here).
3. Security Measures
Each subprocessor implements the following measures, based on its own privacy policy and industry standards (such as SOC 2 Type II and ISO 27001 certification):
- Encryption in transit (TLS 1.2 or higher)
- Encryption at rest (equivalent to AES-256)
- Access control and the principle of least-privilege authentication
- Audit logging and breach detection
- Employee training and confidentiality agreements
We confirm that these measures are appropriately implemented when selecting our subprocessors.
5. Contact
For inquiries about this page: hello@zanmaido.com / Personal Information Protection Manager: Yuji Kuwamizu