Providers and Processors
To provide our services we work with the providers listed below. This page details what information Makana shares with each of them and for what purpose, in compliance with Chilean personal data protection law (Ley 19.628 and Ley 21.719). Most of these providers process the data outside Chile, mainly in the United States, which constitutes an international transfer of data. Each provider's retention periods were verified against their official policies and documentation; where a provider does not publish a period, we say so explicitly.
Last updated: July 21, 2026. This list is part of our Privacy Policy.
1. Data processors
Providers that process personal data on Makana's behalf in order to deliver the service. They cannot use your data for their own purposes.
Google Cloud Platform
Infrastructure and storage- Data shared
- Account data, content and files you upload to the platform, encryption keys, notification tokens
- Purpose
- Hosting the platform, file storage, custody of encryption keys and push notifications
- Location
- United States and Chile region
- Retention
- Deletes customer data from all of its systems, including backups, within a maximum of approximately 180 days from the deletion or the end of the contract, in accordance with its Cloud Data Processing Addendum. view source
OpenWearables (wearables platform operated by Makana on Google Cloud)
Wearables and health data- Data shared
- Sleep, recovery, heart rate, physical activity, workouts and metrics derived from the devices you connect
- Purpose
- Receiving, normalizing and storing the data from your wearables and health repositories in order to calculate your wellbeing indicators. Open-source software self-hosted on Makana's own infrastructure; the data is deleted if you disconnect and erase the history, or if you delete your account
- Location
- United States
- Retention
- Makana's own infrastructure: the data is kept while the connection is active; when you disconnect you can delete the imported history and, when you close your account, it is erased according to the retention periods in our Terms and Conditions. view source
Google (Gemini, Vertex AI, Cloud Vision)
Artificial intelligence- Data shared
- Conversations with the assistant, onboarding answers, food photos and descriptions, voice recordings, documents you upload for analysis
- Purpose
- AI features: wellbeing assistant, nutritional analysis, extraction of information from documents. Documents with sensitive information are processed on enterprise infrastructure with reinforced privacy terms
- Location
- United States and region
- Retention
- Does not use Makana's data to train its models. It keeps an in-memory cache for a maximum of 24 hours and abuse-monitoring logs for up to 30 days; outside those cases, it does not retain the data it processes. view source
Google Firebase
Analytics, stability and push- Data shared
- Internal user identifier, app usage events, error reports, device information, notification token
- Purpose
- Usage metrics, diagnosis of app errors and delivery of push notifications
- Location
- United States
- Retention
- Varies by service: authentication data is deleted from live systems and backups within 180 days of the account being deleted, and messaging identifiers (FCM) within 180 days of the request. view source
Supabase
Product analytics- Data shared
- App and content usage events (internal identifier, session, device, version)
- Purpose
- Measuring product usage in order to improve it
- Location
- United States
- Retention
- Keeps the data while the project is active, with automatic backups for 7 days; when the project is deleted, the deletion is permanent and irreversible, including the backups. view source
ElevenLabs
Voice AI- Data shared
- Voice audio during conversations with the assistant, transcripts, name and context of the conversation
- Purpose
- Conversational voice assistant and narration of meditation and sleep audio
- Location
- United States
- Retention
- Does not publish a fixed period for content processed through the API; voice-derived data is kept for up to 3 years from the last interaction and backups for up to 30 days after a deletion. view source
Deepgram
Voice transcription- Data shared
- Voice notes you record (for example, to log meals or finances)
- Purpose
- Turning your voice into text
- Location
- United States
- Retention
- Does not publish a fixed retention period; it offers the option to exclude each request from its model improvement program, in which case the data is retained only while the request is being processed. view source
Kapso (over Meta's WhatsApp)
WhatsApp messaging- Data shared
- Phone number, name and content of the WhatsApp conversations with Makana
- Purpose
- Welcome messages, reminders, follow-ups and support over WhatsApp
- Location
- United States
- Retention
- Keeps the messages while Makana's account is active; when the service ends they are permanently deleted within 30 to 90 days. WhatsApp does not keep messages once delivered and erases undelivered ones after 30 days. view source
Twilio
SMS- Data shared
- Phone number and verification code
- Purpose
- Sending verification codes by SMS
- Location
- United States
- Retention
- Keeps message logs for 13 months (configurable between 7 and 400 days); attached media files are deleted after 13 months. view source
Resend
Email- Data shared
- Email address and content of transactional emails
- Purpose
- Sending service emails (notifications, reports, billing)
- Location
- United States
- Retention
- Keeps the logs and the content of the emails sent for 30 days. view source
RevenueCat
Subscriptions- Data shared
- Internal user identifier and transaction identifiers
- Purpose
- Managing and verifying subscriptions inside the app
- Location
- United States
- Retention
- Keeps subscriber data while the account is active, with individual deletion available at any time; when the contract ends, it returns or destroys the data within 30 days in accordance with its DPA. view source
Paddle
Web payments- Data shared
- Billing and transaction data for web purchases
- Purpose
- Processing payments, refunds and discounts for web purchases
- Location
- United Kingdom and United States
- Retention
- Acts as an independent controller (merchant of record): it keeps billing data for the duration of the relationship and, afterwards, for the statutory limitation periods applicable to tax and accounting records; once those expire, it deletes or anonymizes the data. view source
OhGiftCard
Gift cards- Data shared
- Recipient's email and name, amount and personal message
- Purpose
- Issuing and sending digital gift cards
- Location
- Chile
- Retention
- Does not publish a data retention policy; the rights of access, rectification and erasure are exercised directly with Gift Card Chile SpA. view source
Progressier and browser push services (Apple, Google, Mozilla)
Web notifications- Data shared
- Push subscription identifier and content of the notification
- Purpose
- Push notifications in the web version of the app
- Location
- United States
- Retention
- Keeps the data only for as long as the purpose of the service requires; notification tokens become invalid when the permission is revoked or the application is uninstalled. view source
Shorebird
App updates- Data shared
- Technical identifiers of the app and the device
- Purpose
- Delivery of application updates
- Location
- United States
- Retention
- Only processes anonymous device identifiers, with no user content, and retains them solely for as long as is reasonably necessary to deliver updates. view source
Google reCAPTCHA
Security- Data shared
- IP address and browser behavior signals at the company portal login
- Purpose
- Protection against automated access
- Location
- United States
- Retention
- Independent controller: does not publish a specific period; it keeps the data in accordance with Google's retention policy and does not use it for personalized advertising. view source
Google Maps Platform
Locations- Data shared
- Place search text when creating community events
- Purpose
- Autocompleting addresses and places
- Location
- United States
- Retention
- Independent controller: it keeps the search terms, the IP address and the coordinates in accordance with Google's retention policy, with no specific period published. view source
Lovable (with Google Gemini)
AI in the company portal- Data shared
- Queries from the HR administrator and aggregated company metrics (no individual data)
- Purpose
- AI assistant of the company portal
- Location
- United States and Europe
- Retention
- Keeps the data while the account is active; once it ends, it deletes the data within 30 days, with backups that may persist for up to 90 additional days. It states that it does not use identifiable data to train models. view source
2. Advertising and measurement
Providers that receive data for the purpose of measuring advertising campaigns.
Meta (Facebook)
Ad attribution- Data shared
- App usage events, internal user identifier and the device's advertising identifier (depending on your tracking permissions)
- Purpose
- Measuring the effectiveness of advertising campaigns
- Location
- United States
- Retention
- Independent controller: it keeps event data for a maximum of 2 years; audiences are kept until they are deleted from the ad account. view source
3. Services you choose to connect
These integrations only run if you turn them on voluntarily. You can disconnect them at any time.
Wearables: Whoop, Strava, Garmin, Apple Health and Health Connect (Google/Samsung)
Health and activity data- Data shared
- Sleep, recovery, heart rate, physical activity and workouts recorded by your device
- Purpose
- Feeding your wellbeing profile with the data from your wearable. You authorize the connection directly with each brand through OAuth, or from your phone's health repositories (Apple Health / Health Connect). You can disconnect each device from the app at any time and choose whether to keep or delete the imported historical data
- Location
- United States
- Retention
- Each provider is an independent controller under its own policy: Strava takes up to 45 days to erase the data after the account is deleted; Whoop and Garmin keep it while the account is active or for as long as the law requires; Apple Health and Health Connect store the data on your own device, under your control.
Your bank (bank aggregation)
Financial data- Data shared
- Bank credentials (transmitted encrypted and, while you keep the connection active, stored encrypted and protected with your finance PIN, solely to retrieve your information; you can disconnect the bank and revoke the authorization at any time) and your transactions, balances and accounts
- Purpose
- Automatically syncing your personal finances inside the app
- Location
- Chile
- Retention
- Your bank is an independent controller and keeps your data under its own policy. Makana stores your credentials encrypted only while the connection is active: they are deleted immediately when you disconnect (backups for up to 14 days) and the imported transactions remain until you decide to delete them or you close your account. view source
Anthropic (Claude)
AI connector- Data shared
- The data in your Makana account that you query from Claude (finances, training, nutrition, wellbeing) if you connect Makana as a connector
- Purpose
- Letting you use your Makana data from your own Claude account. The data queried is subject to Anthropic's retention policy
- Location
- United States
- Retention
- Independent controller with respect to your Claude account: standard retention of 30 days if you do not allow your chats to be used for training, and up to 5 years in de-identified form if you do. The content the Makana connector delivers through MCP is not used to train models, unless you manually copy it into the conversation. view source
4. Sign-in
If you choose to sign in with these providers, they verify your identity to Makana.
Google Sign-In
Identity- Data shared
- Email, name and verified identifier of your Google account
- Purpose
- Signing in with Google
- Location
- United States
- Retention
- Independent controller: it keeps the data in accordance with Google's retention policy, until you delete it from your Google Account or it expires automatically; after a deletion, full erasure takes around 2 months. view source
Apple Sign-In
Identity- Data shared
- Email, name and verified identifier of your Apple account
- Purpose
- Signing in with Apple
- Location
- United States
- Retention
- Apple does not keep a history of which apps you sign in to; the data it processes is kept only for as long as its purpose requires or as the law demands. view source
5. Third parties with minimal or no personal information
Services that may log your IP address when content loads, without receiving your identity or any data from your account.
Open Food Facts
Nutritional information- Data shared
- Barcode of the scanned product (with no user identification)
- Purpose
- Looking up nutritional information about products
- Location
- France
- Retention
- The query to its public food database is made from your device and only sends the product's barcode, without your identity; as with any connection, Open Food Facts logs technical data (such as the IP address), which it keeps for 3 years. view source
Google Fonts
Web fonts- Data shared
- IP address and browser when the fonts load
- Purpose
- Fonts for our websites
- Location
- United States
- Retention
- Font requests carry no cookies and are not linked to user profiles; the technical logs are used only to serve the fonts and to generate aggregated statistics, with no specific period published. view source
YouTube (Google)
Embedded videos- Data shared
- IP address, browser and Google cookies when videos are played
- Purpose
- Videos of routines and wellbeing protocols
- Location
- United States
- Retention
- Independent controller: it keeps the data in accordance with Google's retention policy, anonymizing IP addresses after 9 months and cookie data after 18 months in advertising data. view source
Unsplash
Images- Data shared
- IP address and browser when images load
- Purpose
- Interface images
- Location
- Canada
- Retention
- Makana only consumes images, without transmitting users' personal data; the technical logs Unsplash collects are kept only for as long as their purpose requires. view source
We may update this list when we add or replace providers. If you have questions about the processing of your personal data or you want to exercise your rights, write to privacidad@makana.cl.