Subprocessors
The named third parties that help Mova deliver translation, voice and messaging — what they do, where they process data, and the safeguards that apply.
About this list
To provide automatic translation, voice messaging and related features, Mova relies on a small number of third-party service providers (“subprocessors”) that process personal data on our behalf and under contract. This page names them, explains what each one does, and shows where it processes data. It supplements section 17 (“International transfers”) of our Privacy Policy.
Each subprocessor processes data only to provide its service to Mova, according to its agreement with us. We keep this list current; the “Last updated” date above reflects the most recent change.
Current subprocessors
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Google LLC | Automatic translation of message text and images (Gemini models) | United States (data centres in the US and EU) | EU–US Data Privacy Framework + SCC |
| OpenRouter, Inc. | AI gateway that routes translation requests to the model above | United States | SCC |
| OpenAI, L.L.C. | Image generation and translation-quality checks | United States | SCC (DPF where self-certified) |
| ElevenLabs Inc. | Text-to-speech, speech-to-text (fallback), and voice-profile (voice clone) generation — biometric data | United States | SCC (DPF where self-certified) |
| Deepgram, Inc. | Speech-to-text for voice messages and calls | United States | SCC (DPF where self-certified) |
| RevenueCat, Inc. | Subscription and purchase status | United States | SCC (DPF where self-certified) |
| Apple Inc. (APNs) | Push notifications on iOS | United States | EU–US Data Privacy Framework + SCC |
| Google LLC (Firebase Cloud Messaging) | Push notifications on Android | United States | EU–US Data Privacy Framework + SCC |
| Seven communications GmbH (seven.io) | Sending SMS one-time verification codes | Germany EU | Within the EU/EEA — no transfer |
| Fornex Hosting S.L. | Server, database and file-storage hosting / infrastructure | EU EU | Within the EU/EEA — no transfer |
Voice profiles are biometric data. A voice model created by ElevenLabs is special-category (biometric) data under Art. 9 GDPR. Mova generates one only with your separate, explicit consent, and deleting your voice profile in the app also removes the model from the provider.
Transfers & safeguards
Where a subprocessor is located in the United States, personal data is transferred outside the European Economic Area. For those transfers, Mova relies on the safeguards required by Chapter V of the GDPR:
- Where the provider is self-certified under the EU–US Data Privacy Framework (DPF), we rely on that Framework.
- In all cases we rely on the European Commission's Standard Contractual Clauses (SCC) as a baseline safeguard, together with additional technical and organizational measures where needed.
Providers marked EU process data within the EU/EEA, so no Chapter V transfer applies.
Changes
This list may change as the service develops — for example if we add, replace or remove a provider. When it does, we update this page and, for material changes, may announce them in the app or on this website. For questions, contact support@getmova.io.