Sub-processors
The short version
These are the outside companies involved in running HERmones, and exactly what each one receives. No advertising company is on this list, because none of them receives anything about your body, your cycle, or your symptoms.
What you log is held on our servers, and the entries needed for your daily reading are sent to an AI provider that writes it. Both are named below. We would rather be exact about that than let you assume otherwise.
To run HERmones we rely on other companies for things like hosting, generating your reading, and processing your subscription. In law they are our processors: they handle information only on our instructions, under a written contract, and never for their own purposes. This page names every one of them, so the promise in our Privacy Policy and our Consumer Health Data Privacy Policy is something you can check rather than something you have to take on trust.
1. Who we use, and what each one receives
| Company | What they do for us | What they receive |
|---|---|---|
| Amazon Web ServicesUS East (N. Virginia) | Hosts our servers and API, and stores account records | Your account record and the entries you log — this is where your history is held and where most processing happens. |
| OpenAIUnited States | Writes some of the words in the App — Rage Room responses, and the written text that goes with your insights | Only the entries that piece of text needs. Contractually barred from using them for its own purposes or training its models on them. It holds them up to 30 days in its own abuse-monitoring logs before deleting — that retention is theirs, and we cannot shorten it. |
| TwilioUnited States | Delivers one-time sign-in codes | Your phone number and the code itself. Nothing about what you log. |
| PostHogEU cloud | Shows us which features get used, so we can tell what is working | That a feature was opened, and on what kind of device. Never the content of an entry, a symptom, a date, or a reading. Session replay and autocapture are switched off. |
| CloudflareGlobal | Network delivery and security — keeps the service reachable and blocks attacks | Connection information such as IP address, handled in transit to route and protect the request. It is not a store of your health information. |
| RevenueCatUnited States | Manages subscriptions and purchases | Your subscription status and purchase records. Nothing about what you log. Your card details go to Apple or Google, never to us. |
| SentryUnited States | Tells us when the App crashes, so we can fix it | Technical crash and diagnostic information — which screen failed and why. Not your logs, and not your readings. |
| PostmarkUnited States | Sends account email — sign-in codes, password messages, account notices | Your email address and the contents of that message. |
| KlaviyoUnited States | Sends marketing email, if you asked for it | Your email address, your name where you gave it, and whether you opened or clicked. Nothing you log in the App. |
| VercelGlobal edge | Hosts hermones.com | Ordinary web request information for the website only. The website is a separate system from the App. |
| Apple Inc. and Google LLCUnited States | Distribute the App and process payment for it | Account identifiers and purchase information, under their own privacy policies. They do not receive your logs from us. |
Some of the words in the App are written by OpenAI, not by us — the Rage Room responses, and the written text that goes with your insights. For those, we send only the entries that piece of text needs.
Most of the App does not involve AI at all. Your hormonal age is calculated by us, not generated. HERoscope, the Playbook and Waking Hours are written in advance by people — nothing is sent anywhere to produce them. If we ever change provider, or start using AI somewhere new, it will be named here before the change happens.
2. The website, separately
hermones.com uses ordinary web analytics so we can tell whether the site works. These services see visits to the website. They have no connection to the App, and they never receive anything you log.
| Company | What they do | What they receive |
|---|---|---|
| Google AnalyticsUnited States | Counts website visits | Browser, device and page-visit information from hermones.com. |
| Microsoft ClarityUnited States | Shows how pages are used, so we can fix what confuses people | Website interaction information from hermones.com, including how a page was scrolled and clicked. |
| KlaviyoUnited States | Recognises you on the website if you are on our mailing list | Which pages you visited on hermones.com, linked to your email profile where you are a subscriber. |
No advertising network operates on hermones.com. The Meta pixel was removed on 25 August 2026, and the unused Google Tag Manager container has been deleted. The analytics services named above see the website only — nothing you log in the App ever reaches them, because the website and the App are separate systems.
3. Who is not on this list
A list like this only means something if you can also see what has been kept off it deliberately.
- No advertising network. Nothing you log, and nothing about your cycle, symptoms, or readings, goes to any advertising platform. We do not sell your information.
- No data broker. We do not buy information about you and we do not sell or trade what we hold.
- No AI training, by anyone. Not by us, and not by the company that generates your reading.
- No employer, insurer, or clinic. Nobody in those categories receives anything, ever.
- No affiliate. No other company in our group receives your health information.
4. What we require of every company here
Every company on this page is engaged under a written data processing agreement. Those agreements require them to:
- Act on our instructions only. They may use the information to do the job we hired them for, and for nothing of their own.
- Not train on it. They may not use it to train or improve any model or system.
- Not keep it longer than needed. They delete it when the job is done, or when the contract ends.
- Protect it, and tell us quickly if something goes wrong — so we can meet our own notification deadlines.
- Bind their own suppliers to the same terms before passing anything on.
- Transfer it lawfully. Where information leaves your region, the transfer runs on legally recognised safeguards — standard contractual clauses, or the UK addendum.
5. How you find out when this changes
This page is the list. When it changes, it changes here first.
- Adding or removing a company: the page is updated and the change is dated in the log below, so you can see the shape of it over time rather than just today's snapshot.
- A material change — a new kind of information going somewhere new — is announced in the App as well, at least 30 days before it starts, so you have time to look at it and decide.
| Date | Version | What changed |
|---|---|---|
| 7 October 2026 | 1.0 | First published. |
6. Contact
If you want to know more about any company on this page — what it holds, or why we use it — write to privacy@hermones.com and a person will answer you.
| Company | Unbroken Consulting Pte. Ltd. 68 Circular Road, #02-01, Singapore 049422 |
|---|---|
| Privacy and data protection | privacy@hermones.com |
| Privacy Policy | hermones.com/privacy |
| Consumer Health Data Privacy | hermones.com/health-privacy |
| Terms of Service | hermones.com/terms |