← Back

Data Subprocessors List — Whispet

Version: 2.3  |  Effective date: March 1, 2026  |  Last updated: May 3, 2026

General Information

This document contains information about third parties (subprocessors) that may process personal data of Whispet application Users on behalf of the Data Controller.

Data Controller: CRE8EVE Sp. z o.o. (KRS: 0000912669, NIP: 8513262229, Tulipanowa 4, 72-003 Dobra, Poland)

This document is made available in accordance with the requirements of Art. 28 GDPR regarding transparency in the further entrustment of data processing.

List of Subprocessors

1. Apple Inc. — Vision framework

Parameter Value
**Entity** Apple Inc.
**Service** Apple Vision framework
**Data scope** Pet photos (processed locally)
**Purpose** Pet photo detection in gallery (Smart Detection)
**Processing** **Exclusively on the User's device (on-device)**
**Data transfer** **None** — no data is transmitted to external servers
**Notes** Vision framework operates offline, without an Internet connection

Vision VNRecognizeAnimalsRequest processes data entirely locally on the device. Apple does not receive the processed photos or analysis results — the framework is part of the iOS system and operates offline. From a technical standpoint, Apple is not a subprocessor for this service, but we disclose it for full transparency.

Smart Pet Photo Detection: The "Find Pet Photos" feature uses the same Vision VNRecognizeAnimalsRequest model to scan the gallery to identify photos containing animals. Analysis is performed on 800x800 thumbnails exclusively on the device. No data is transmitted to servers.

1a. Apple Inc. — Vision Framework (disabled)

Parameter Value
**Entity** Apple Inc.
**Service** Apple Vision Framework — VNGenerateImageFeaturePrintRequest
**Data scope** None — feature disabled
**Purpose** Generating visual feature prints for photos
**Processing** **Code present in the App, but currently inactive**
**Data transfer** **None** — the feature is not invoked, no data is processed
**Notes** The feature does not distinguish individual pets and has been disabled. If activated in the future, processing will be performed exclusively on the device (on-device).

Apple Vision Framework is a system framework operating exclusively on the device. The feature print code is present in the App but is not invoked. No data is processed or transmitted.

2. Apple Inc. — App Store / In-App Purchase

Parameter Value
**Entity** Apple Inc.
**Registered office** One Apple Park Way, Cupertino, CA 95014, USA
**Service** Apple In-App Purchase, App Store
**Data scope** Transaction data (transaction ID, subscription status)
**Purpose** Processing subscription payments (iOS/macOS)
**Notes** The Controller **does not have access** to payment data (card numbers, bank details). Apple processes payments as an independent data controller.
**Privacy policy** https://www.apple.com/legal/privacy/

3. Apple Inc. — iCloud / CloudKit

Parameter Value
**Entity** Apple Inc. (iCloud / CloudKit)
**Registered office** One Apple Park Way, Cupertino, CA 95014, USA
**Service** Apple iCloud / CloudKit (User's private database and sharing database)
**Purpose of processing** Synchronization of User's data across devices within their iCloud account (pets, photos, entries, reminders, medical data) and Shared Care functionality (sharing selected pets with designated people)
**Data categories** All User data created in the app (except UI cache and local settings): pet profiles, photos, event journals, medical data (vaccinations, medications, vet visits, allergens, food, documents), Shared Care data (invitations, Participants list)
**Location** Apple data centers (EU and USA — end-to-end encryption ensures Apple does NOT have access to data content)
**Transfer basis** Standard Contractual Clauses of the EU Commission — Apple is an officially certified entity
**Security** Encryption at-rest (AES-256) and in-transit (TLS 1.3). User data in private iCloud database is encrypted with a key protected by the iCloud account. Apple declares it does NOT have access to user data content (privacy by design — Apple's "Data Protection Whitepaper").
**Privacy policy** https://www.apple.com/legal/privacy/
**Data Processing Agreement** iCloud Terms of Service (part of User's Apple ID account terms) + Apple Developer Program License Agreement (DPA for apps)

Note on Shared Care: The pet sharing feature ("Shared Care") operates exclusively through the Apple CloudKit sharing infrastructure. Each shared pet has its own isolated area within the Owner's iCloud database. All Shared Care data flows directly between participants' devices via Apple servers — the Controller does NOT mediate the transfer or have access to the shared content. The feature is not related to the Apple iCloud Family Sharing platform service.

4. Apple Inc. — APNS (Apple Push Notification Service)

Parameter Value
**Entity** Apple Inc. (APNS — Apple Push Notification Service)
**Registered office** One Apple Park Way, Cupertino, CA 95014, USA
**Service** Apple Push Notification Service
**Purpose of processing** Delivery of push notifications to User's devices (reminders for vaccinations/medications/visits, silent notifications about new changes in shared pets in Shared Care)
**Data categories** Device token (push notification token) — assigned to User's Apple ID. Notification content (encrypted in transit). No access to other app data.
**Location** Apple data centers (EU and USA)
**Transfer basis** Standard Contractual Clauses of the EU Commission
**Security** TLS 1.3, cryptographic tokens, notification payload encryption
**Privacy policy** https://www.apple.com/legal/privacy/
**Data Processing Agreement** Apple Developer Program License Agreement

4a. Apple Inc. — Apple Speech Recognition Service (fallback only)

Parameter Value
**Entity** Apple Inc. (Apple Speech Recognition Service)
**Registered office** One Apple Park Way, Cupertino, CA 95014, USA
**Service** Apple Speech Recognition Service (cloud-based STT) — used exclusively in the fallback mode of the App's speech dictation feature
**Purpose of processing** Speech-to-text transcription for medical form fields and photo descriptions — **only when on-device speech recognition is NOT available** for the selected system language (`recognizer.supportsOnDeviceRecognition == false`). In the default path (on-device available) Apple Speech Recognition Service is **not used** and the audio stream does not leave the device
**Data categories** Audio stream from microphone — only during an active dictation session (user-driven, opt-in via UI). Session ends immediately upon release of the microphone button or when the screen is closed
**Location** Apple data centers (USA and Apple regions)
**Transfer basis** Standard Contractual Clauses of the EU Commission (Apple DPA)
**Security** TLS 1.3, audio stream encryption in transit; Apple does not retain audio when "Improve Siri & Dictation" is disabled in iOS Settings → Siri & Search
**Retention** On Apple's side — per Apple's policy. If the User has disabled "Improve Siri & Dictation" in iOS Settings, Apple does **not retain** audio after transcription completes
**Privacy policy** https://www.apple.com/legal/privacy/
**Data Processing Agreement** Apple Developer Program License Agreement + Apple Standard Contractual Clauses
**Legal basis (GDPR)** Art. 6(1)(a) GDPR (consent) — iOS permission dialog on first use of the dictation feature
**User control** iOS Settings → Whispet → Speech Recognition / Microphone (revoke consent at any time); iOS Settings → Siri & Search → "Improve Siri & Dictation" (off — Apple does not retain audio)
**EU AI Act classification** Minimal risk — Apple Speech is a specialized transcription model explicitly excluded from the FLOPs threshold per the EU AI Act Guidelines for GPAI Providers (2025); Art. 50 transparency obligations do NOT apply to speech-to-text
**EDPB reference** Per EDPB "Guidelines on Virtual Voice Assistants" (2021) consent (Art. 6(1)(a)) is the only valid legal basis for audio improvement of ASR models

Note: The speech dictation feature applies a privacy-by-default principle — request.requiresOnDeviceRecognition is set from recognizer.supportsOnDeviceRecognition in DictationEngine.start(). For most users with common system languages (iOS 13+) audio does not leave the device — the Apple Speech Recognition Service subprocessor listed above applies only to the fallback path (rare locales, older hardware). A planned migration to iOS 26+ SpeechAnalyzer (full on-device replacement) will eliminate the fallback path entirely.

Changes to the Subprocessors List

The Controller undertakes to update this document in the event of changes to subprocessors or the scope of data processing.

The User will be informed of significant changes through the Application.

Contact

For inquiries regarding data subprocessors:
E-mail: hello@whispet.app

Document generated for Whispet app v1.1