This page lists the third parties that process personal information on behalf of 15064121 Canada Inc., doing business as CoCo Parenting AI (our "subprocessors"). Every subprocessor is bound by a written data-processing agreement (DPA) that requires them to: (a) process personal information only on our instructions; (b) apply appropriate technical and organizational security; (c) support data-subject requests; and (d) delete or return data on termination.
We review this list at least twice a year. We will give at least 30 days’ notice of any new subprocessor by updating this page and posting an in-app notice where material. If you have a reasonable objection, contact support@cocoparentingai.com with the subject line "Subprocessor objection" within that window — we will work with you in good faith (which may include ending your subscription with a pro-rata refund if no workable alternative exists).
| Subprocessor | Purpose | Data categories | Location / safeguards | DPA |
|---|---|---|---|---|
| Google LLC (Firebase, Google Cloud, FCM) | Authentication, Firestore database, Cloud Storage, hosting, push notifications (FCM), analytics | Account + profile data, children’s data entered by parents, activity logs, device tokens | United States (with EU SCCs via Firebase / Google Cloud Data Processing Addendum) | Link |
| Vercel Inc. | Web hosting, content delivery, edge caching | Request logs, IP address (truncated for analytics), device type | United States; global CDN edge nodes | Link |
| Stripe, Inc. | Payment processing, subscription billing for web purchases | Payment method, name, billing address, email, transaction data | United States (EU SCCs + UK Addendum via Stripe DPA) | Link |
| Apple Inc. (App Store, In-App Purchases) | iOS app distribution and in-app purchase processing | Transaction receipts (we do not receive card data) | United States and regional Apple data centers | Link |
| Google LLC (Google Play / Play Billing) | Android app distribution and in-app purchase processing | Transaction receipts, Play account identifier | United States and regional Google data centers | Link |
| OpenAI, L.L.C. | AI model inference (Coco chat, personalized content) | Prompt content + minimal personalization context (child first name/age, preferences, stage) | United States (zero-retention API endpoints; no training on our content) | Link |
| Resend, Inc. | Transactional and reminder emails | Email address, email content, delivery events | United States (EU SCCs via Resend DPA) | Link |
| Functional Software, Inc. (Sentry) | Error monitoring, performance diagnostics | Stack traces, device and app metadata, request IDs (PII scrubbed before transmission) | United States (EU region option; EU SCCs via Sentry DPA) | Link |
| WeatherAPI.com | Local weather data for activity suggestions | Coarse city/region only (no child data, no account data) | United Kingdom | — |
Changes
When we add, remove, or substantively change a subprocessor, we update the "Last updated" date at the top of this page and publish a short change note below for 12 months.
Contact
support@cocoparentingai.com — use the subject line "Subprocessors".
See also our Privacy Policy and Cookie Policy.