Subprocessors

About This List

Meshi (operated by Renya Studios LLC) uses the third-party service providers listed below to operate the service. Under Article 28 of the EU General Data Protection Regulation (GDPR) and equivalent provisions of the UK GDPR, we disclose these "subprocessors" — vendors that process personal data on our behalf — together with the purpose of processing, the category of data involved, and the country of processing.

We engage each subprocessor under a written data processing agreement that obligates them to process personal data only on our documented instructions, to maintain appropriate technical and organizational safeguards, and to assist with data-subject rights requests.

International transfers to the United States rely on Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework.

Current Subprocessors

Supabase, Inc.

Purpose:: Managed Postgres database, authentication, file storage
Data category:: Account PII (email, hashed password, MFA factors), recipes, meal plans, pantry data, user-generated content
Location:: United States

Stripe, Inc.

Purpose:: Payment processing and subscription billing
Data category:: Billing details, payment method tokens, subscription status (we do not store full card numbers)
Location:: United States

OpenAI, OpenAI L.L.C.

Purpose:: AI model inference for recipe generation, chat, and culinary suggestions
Data category:: Prompts, recipe inputs, chat messages submitted to AI features
Location:: United States

Google LLC

Purpose:: AI model inference (Gemini family) for recipe generation, chat, and culinary suggestions; web font delivery (Google Fonts)
Data category:: Prompts and chat messages (AI inference); IP address and user agent (font CDN, when fonts are served from Google rather than self-hosted)
Location:: United States

fal.ai (Features and Labels Inc.)

Purpose:: AI image generation (Flux Pro) for recipe and cocktail visuals
Data category:: Image generation prompts derived from recipe metadata
Location:: United States

Vercel, Inc.

Purpose:: Application hosting, edge runtime, and CDN
Data category:: All HTTP request metadata (IP, user agent, request paths), authenticated session cookies in transit
Location:: United States

Sentry (Functional Software, Inc.)

Purpose:: Error monitoring and performance tracing
Data category:: Error stack traces, request context (PII-scrubbed via server-side filters), browser metadata
Location:: United States

Upstash, Inc.

Purpose:: Redis-backed API rate limiting
Data category:: IP address rate-limit buckets, user ID rate-limit buckets (short-lived; no recipe content)
Location:: United States

Resend (Resend.com / Resend Inc.)

Purpose:: Transactional email delivery (account confirmation, password reset, beta invitations, support replies)
Data category:: Recipient email address, email subject and body content
Location:: United States

Changes to This List

We update this page when we add or remove a subprocessor. Material changes are additionally announced via in-app notice or email at least 30 days in advance for users on paid plans, where commercially feasible.

Contact

Questions about our subprocessors or data-processing practices: contact us at alex@meshi.recipes.