# Subprocessors

The providers that process data for us, with their location and instrument. Lemon Squeezy is not here because it charges as an independent controller.

Last reviewed: 2026-11-09

## Providers

These are the providers that process personal data on behalf of Murabi OÜ. The list matches the internal register and is updated with every change. This English text is a courtesy translation; the Spanish version is the operative one.

| Provider | Service | Data | Location | Safeguard |
| --- | --- | --- | --- | --- |
| Google Cloud (Firebase Authentication) | authentication | email, UID, credential | EU / US | Firebase DPA + SCC + TIA |
| Google Cloud (Gemini) | photo reading and ingredient matching | image, ingredient names | EU on Vertex AI; the API key mode uses the service location | Google Cloud DPA + SCC + TIA |
| Google Cloud (Cloud Run, Secret Manager, Cloud Logging) | hosting and logs | request metadata without IP | europe-west4 (Netherlands) | Google Cloud DPA + SCC + TIA |
| Managed PostgreSQL provider | database | account, preferences, allergens, plans, basket, recipes and problem reports | EU | provider DPA + SCC |
| Lemon Squeezy | payments and subscriptions | email and subscription identifiers; it collects the payment data | US | independent controller (merchant of record), not a subprocessor |

## Change notice

Before adding a subprocessor that processes personal data, we publish the change here at least 30 days in advance and update the date. If you object, write to contract@murabi.io before it takes effect.

## Contact

To object to a change or ask for the detail of an instrument, write to contract@murabi.io.

## Controller

The controller’s identity and the purposes are in the privacy policy.

[Read the privacy policy](/legal/privacidad)

---
Source: https://cuadra-staging.murabi.io/en/legal/subencargados