Endyoro Sub-processors

These are the companies that handle your data on our behalf, what each one receives, and where it is. This page is the current list. We update it whenever the list changes.

What a sub-processor is

A company we bring in to do one job with your data — hosting it, delivering an email, reading a meal photo — on our instructions and for no purpose of its own.

The list

• Application hosting, database, cache and photo storage

  Amazon Web Services

  Mumbai, India (ap-south-1)

  Everything in your account: profile, training sessions, GPS routes, strength work, nutrition, wellness and recovery data, body measurements, coaching records and coach notes, and the run and profile photos you upload (location and camera data removed first). Connected-source access tokens are encrypted before they are stored, and a paired watch is identified by a hash of its device token.

• Website delivery

  Amazon Web Services (Amplify and CloudFront)

  Mumbai, India, served through a worldwide network

  Requests for the pages and files of endyoro.com, including your internet address and browser details. No training, nutrition, health or coaching content is stored there.

• Email delivery

  Brevo

  European Union

  Your email address, your name and the content of the emails we send you: sign-in codes, account notices, coach invitations and anything you have opted into. No training, nutrition, health or coaching content.

• WhatsApp sign-in codes

  Gupshup, delivering through WhatsApp (Meta)

  India (Gupshup), and WhatsApp’s own servers (Meta)

  Your mobile number and the one-time code, only when you sign in with WhatsApp or add a number to your account. No name, email, training, nutrition, health or coaching content.

• Product analytics, in the signed-in app

  PostHog

  European Union

  Which screens you open and which actions you take, tied to an account identifier. No training, nutrition, health or coaching content. We do not record your screen.

• AI model: training assistant, dashboard summary and meal reading

  Google (Gemini, through Google Cloud Vertex AI or the Gemini API)

  Google data centres

  The question you ask the training assistant and the training and nutrition figures needed to answer it; your training, recovery and fuelling figures, to write the short summary on your dashboard; the photo or description of a meal you ask us to read. To identify a branded or packaged food, Google may search the web with the food name and your meal description. Never your name or your email address.

• Weather at the time of a session — runs synced within a day

  Google (Weather API, Google Maps Platform)

  Google data centres, including the United States

  The coordinates and time of a session, sent from our servers so we can record the conditions. No name, no account identifier, no other data.

• Weather at the time of a session — older sessions

  Visual Crossing

  United States

  The coordinates and time of a session, sent from our servers so we can record the conditions. No name, no account identifier, no other data.

• Packaged-food lookup by barcode

  Open Food Facts

  France

  The barcode number of a product, sent from our servers. Nothing about you.

• Map images on route maps, web app

  CARTO

  Served through a worldwide network

  When you open a route map in the web app, your browser fetches map images for that area. CARTO sees your internet address and the map area, not your account.

• Map images on route maps, Android app

  Google Maps

  Google data centres

  When you open a route map in the Android app, the map for that area is loaded from Google. Google sees your device and the map area, not your Endyoro account.

• Push notifications to the mobile app

  Expo (Expo Application Services)

  United States

  A push identifier for your phone, and the one-word instruction we send it — today only a silent "check for new sleep data" signal that wakes the app so it can upload readings your phone already holds. No name, no email address, and no training, nutrition, health or coaching content.

• Visit statistics, public home page

  Google Analytics

  Google data centres

  Visit statistics for the public home page of endyoro.com: pages viewed, approximate location, device and browser. It is loaded only on the home page. If you are signed in and open the home page, it may also count the page you are then taken to. It never receives training, nutrition, health or coaching content.

We use each of these companies under its contract or published terms, and we send each one only what its job needs.

Services you connect yourself

Some services are not on this list because you choose to connect them: signing in with Google, a COROS account, a Garmin Connect account, and Health Connect on Android. When you connect COROS and turn on “Send my plan to COROS”, we send COROS the runs in your plan and update or cancel them when they change; when you disconnect or delete your account, we cancel the upcoming ones and withdraw our access at COROS. When you link a Garmin Connect account and turn on “Send my plan to Garmin”, we send Garmin the workouts and courses in your plan and update or remove them when they change; when you disconnect or delete your account, we ask Garmin to remove them and end the link. Each of these services handles your data under its own privacy policy and terms.

What we do not use

• No advertising networks, on any surface.
• No data brokers. We do not buy data about you or supply it to anyone who sells it.
• No session-replay tools. We do not record your screen, mouse or keystrokes.

We do not sell your personal data, and we do not use it to target advertising.

When this list changes

We update this page when we add a sub-processor, remove one, or move one to a different provider or region. If a change materially affects how your data is handled, we tell you in the app or by email before it takes effect.

To be told about changes, email privacy@endyoro.com and ask to join the sub-processor notification list.

Questions

Anything about this list: privacy@endyoro.com. Our Privacy Policy explains how these providers fit into the wider platform.

Endyoro Sports Technologies Private Limited · CIN U62011RJ2026PTC117713 · Jaipur, India