Data Processing Agreement
Last updated:
1. Parties
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Donny Wonny ("Data Controller") and the user ("Data Subject"). This DPA governs the processing of personal data by our authorized sub-processors in connection with providing the Donny Wonny service.
2. Sub-processors
We use the following sub-processors to deliver our services. Each has been vetted for GDPR compliance:
| Sub-processor | Purpose | Data Categories | Location |
|---|---|---|---|
| Google Firebase / Firestore | Authentication, database, hosting | Account data, app data | US (us-central1, Iowa) |
| Vercel, Inc. | Website hosting and edge delivery | HTTP logs, deployment metadata, cookie-consent-gated analytics | US / global edge |
| Stripe | Payment processing, mentor Stripe Connect payouts | Payment info, billing address | US / EU |
| OpenAI | AI companion interactions | Chat / journal text content (sent under OpenAI's API no-training-by-default terms) | US |
| Google Cloud Translation v3 | Translate-on-display for opted-in users (see Privacy Policy — Translation) | Text content of public posts, comments on posts and family activities, mentor bios, and mentor circle posts and comments. End-to-end encrypted messages are never translated by default: only after the user explicitly opts in (always or for a single message) is the text, decrypted on their device, sent through our servers to Google for translation | US (multi-region) |
| Sentry | Error monitoring & crash reporting | Technical logs, device info | US |
| SendGrid | Transactional email | Email address, display name | US |
| Twilio Inc. | SMS one-time verification codes (opt-in) | Phone number, verification code | US |
| Redis Cloud (Redis Ltd.) | Short-lived caching, rate limits, real-time delivery between our servers | Account identifiers, counters, real-time events held for seconds to minutes (end-to-end encrypted messages pass through only as ciphertext) | US |
| Google Cloud Speech-to-Text | Transcription of voice messages and some voice uploads | Audio for the transcription request only; not retained by us afterwards | US |
| Google reCAPTCHA v3 / Firebase App Check | Bot and abuse protection (security only) | Device and browser signals; app attestation (Apple App Attest, Google Play Integrity) | US |
| Google Analytics 4 | Optional website analytics, only after analytics cookies are accepted (not used in the mobile app) | Page views, device and browser information; advertising features off | US |
| Open-Meteo | Local weather lookups (opt-in Local Weather) | Device coordinates rounded to about 1 km; no account identifier | EU |
| Slack Technologies, LLC | Internal operational and safety alerts | Alert type, category, shortened account identifier; never journal, chat, or Let It Out text | US |
| GitHub, Inc. | Source code hosting and engineering triage | Title and summary of bug reports or feature requests when triage is on; never account email, journal, or chat content | US |
| Google Cloud Storage | Encrypted DM attachments, voice DM audio, media uploads | User-uploaded files (ciphertext for E2E attachments; voice audio bytes) | US (us-central1) |
| Giphy | GIF search in chat and posts (when user selects a GIF) | Search query terms; no account linkage sent by us | US |
| Daily.co | Live audio/video calls (mentorship and group primitives) | Session metadata, participant identifiers | US / EU |
| Expo (650 Industries, Inc.) | Push notification delivery | Device push tokens, notification titles and bodies (including safety-alert titles/bodies; never journal, vent, or chat content) | US |
| Apple App Store | iOS in-app purchase and subscription billing | Purchase tokens, subscription status (no card numbers to us) | US / regional storefronts |
| Google Play Store | Android in-app purchase and subscription billing | Purchase tokens, subscription status (no card numbers to us) | US / regional storefronts |
| RevenueCat | Mobile subscription lifecycle events and entitlement sync | App user ID, product identifiers, renewal/cancellation events | US |
| Didit (Didit Pte. Ltd.) | Age assurance where required by law | Verification session metadata (not journal or chat content) | Singapore / regional |
| Microsoft Azure Cognitive Services | Optional cloud speech synthesis/recognition for Donny voice features | Audio snippets when the user enables voice features that use Azure | US / regional |
| Printful, Inc. | Print-on-demand merchandise fulfillment | Name, shipping address, email, SKU, order reference | US / EU |
| Lulu Press, Inc. / Lulu Direct | Printed books and paper goods fulfillment | Name, shipping address, email, SKU, order reference | US |
3. Data Processing Purposes
- Providing and maintaining the Donny Wonny companion service
- Processing subscription payments and managing billing
- Delivering AI-powered companion interactions and mood analysis
- Sending transactional emails (account verification, receipts, safety alerts)
- Monitoring application health and diagnosing errors
- Managing Donny Den membership, feeds, and community moderation
- Tracking Journey progress scores, follower relationships, and growth milestones
- Recording Spark Series subscription progress and daily completion data
- Processing group, circle, and couples community interactions
4. Security Measures
All sub-processors implement:
- Industry-standard encryption for data at rest
- TLS 1.2+ encryption for data in transit
- Independent security attestations held by our major sub-processors (for example, Google Cloud/Firebase, Stripe, and OpenAI maintain their own SOC 2 Type II reports). These are the vendors' certifications — Donny Wonny itself is not SOC 2 or ISO 27001 certified
- Security audit programs maintained by each sub-processor under their own certification obligations
- Data breach notification within 72 hours (GDPR Art. 33)
5. Data Subject Rights
You may exercise your rights under GDPR Articles 15–22 (access, rectification, erasure, restriction, portability, objection) by visiting our Data Deletion page or contacting privacy@donnywonny.com. We will relay requests to relevant sub-processors within 30 days.
6. International Transfers
Donny Wonny LLC is based in the United States and our entire production infrastructure runs in US-region Google Cloud Platform: cloud database in a US multi-region (Iowa, South Carolina, Oklahoma), cloud storage and application servers in Iowa. We do not operate separate regional data centers. Personal data of EU, EEA, UK, and Swiss data subjects is therefore transferred to the United States.
For each transfer we rely on one of:
- EU-US Data Privacy Framework (DPF) — adequacy decision adopted by the European Commission in July 2023. Used for our DPF-certified sub-processors (Google Cloud, Stripe, Vercel — verify at dataprivacyframework.gov).
- UK Extension to the EU-US Data Privacy Framework (the “UK Data Bridge”) — active since 12 October 2023. Provides the UK GDPR-equivalent adequacy basis for UK residents.
- 2021 EU Standard Contractual Clauses (SCCs) — Implementing Decision (EU) 2021/914 — incorporated into our DPA with non-DPF-certified sub-processors (currently OpenAI, SendGrid/Twilio, RevenueCat, Sentry).
- UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs — applied alongside the EU SCCs for UK-origin transfers to sub-processors that have not separately certified under the UK Extension to the DPF.
For each non-adequacy-decision sub-processor we maintain an internal Transfer Impact Assessment (TIA) that evaluates the destination-country legal regime, the data category transferred, and the supplementary measures in place (encryption at rest + in transit, access controls, sub-processor audit reports). The TIA is part of our Article 30 Record of Processing Activities and is available to supervisory authorities on request via our EU/UK Article 27 representatives.
7. Data Retention
Personal data is retained only for as long as necessary to fulfill the purposes described above, or as required by law. When you request account deletion, deletion is scheduled with a 30-day cancellation window. After that window, personal data is removed from our active systems within 30 days and from backups within approximately 90 days. Sub-processors operate under their own published retention terms; we relay deletion requests to them where they hold copies of your data.
8. Contact
For questions about this DPA or to exercise rights as a data subject, contact our privacy team at privacy@donnywonny.com. We are a small team and we do not currently maintain a separate, formally appointed Data Protection Officer (DPO) role under GDPR Art. 37 — privacy@donnywonny.com is our accountable contact for these matters.