Privacy
Data sub-processors
Below are all third-party services that process data on behalf of Bliss. Updated whenever a provider is added or removed. For questions or requests to exercise your rights under GDPR, write to us at privacy@bliss.al.
Google Cloud Vertex AI (Gemini)
- Purpose
- Processes the user's text to generate AI twin replies and summaries for the therapist.
- Data
- Chat text messages, the therapist's questionnaire, fragments of the therapist's writing.
- Region
- EU — europe-west4 (Netherlands).
- Legal basis
- Explicit consent (Art. 9(2)(a) GDPR: special category of mental health data).
OpenAI
- Purpose
- Computes embeddings (vectors) for the corpus of knowledge approved by therapists, so the twin can find relevant fragments.
- Data
- Only texts the therapist has explicitly approved as reference materials. No user messages.
- Region
- USA — Standard Contractual Clauses + Data Privacy Framework.
- Legal basis
- Therapist's legitimate interest (twin quality), without user data.
Daily.co
- Purpose
- Video session rooms between the user and the therapist.
- Data
- Audio/video during the session (real-time, not recorded), participant names.
- Region
- EU — eu-frankfurt (signaling).
- Legal basis
- Contractual necessity (delivering the session the user booked).
SendGrid (Twilio)
- Purpose
- Sending transactional emails (session confirmations, reminders, crisis alerts, invoices).
- Data
- Email address, username, session date, email type.
- Region
- USA — Standard Contractual Clauses + Data Privacy Framework.
- Legal basis
- Legitimate interest (operational communication) or contractual necessity.
Stripe
- Purpose
- Processing session payments and storing card details.
- Data
- Email, name, amount, payment identifiers. Card data never passes through our servers.
- Region
- EU — Stripe Technology Europe Limited.
- Legal basis
- Contractual necessity.
This listing represents all active sub-processors at the date this page was published. Material changes are announced before they take effect.