Sub-processors
Who processes data on our behalf.
A versioned register of third-party processors used to operate LumenFlow Cloud, with purpose, data categories, location, and transfer safeguard.
Register version 1.1.0
Current register
We give 30 days' notice before a new sub-processor receives customer data. Customers may object on reasonable data-protection grounds. Subscribe to notices or object by emailing privacy@lumenflow.cloud.
| Processor | Purpose | Data categories | Location | Transfer safeguard | Added |
|---|---|---|---|---|---|
| Supabase | Database hosting and authentication. | Account and workspace records, authentication data, workspace content. | EU (Frankfurt); some authentication edge infrastructure may run in the United States | EU standard contractual clauses with the UK addendum, or an adequacy decision where one applies. | 2026-09-22 |
| Vercel | Application hosting and edge delivery. | Request data and application traffic, including IP addresses. | EU (Frankfurt) | EU standard contractual clauses with the UK addendum, or an adequacy decision where one applies. | 2026-09-22 |
| Stripe | Payment processing for paid plans (web only). | Billing contact details and payment data. | United States and global Stripe infrastructure | EU standard contractual clauses with the UK addendum, or an adequacy decision where one applies. | 2026-09-22 |
| OpenAI | Text inference and, for mobile dictation, voice transcription via the OpenAI Realtime API (forwarded server-side). | Prompts, model inputs and outputs, dictation audio. | United States | EU standard contractual clauses with the UK addendum, or an adequacy decision where one applies. | 2026-09-22 |
| Anthropic | Text inference under the managed-inference tier. | Prompts, model inputs and outputs. | United States | EU standard contractual clauses with the UK addendum, or an adequacy decision where one applies. | 2026-09-22 |
| Google Gemini | Text inference under the managed-inference tier. | Prompts, model inputs and outputs. | United States and Google Cloud regions | EU standard contractual clauses with the UK addendum, or an adequacy decision where one applies. | 2026-09-22 |
| GitHub | Optional connected tool — when a workspace connects its own GitHub account, LumenFlow can read and write to authorised repositories. | Repository content and metadata the workspace authorises, only after a workspace connects it. | United States | EU standard contractual clauses with the UK addendum, or an adequacy decision where one applies. | 2026-09-22 |
| Expo / EAS | Mobile push token issuance and over-the-air update delivery for the mobile app. | Push tokens and device identifiers. | United States | EU standard contractual clauses with the UK addendum, or an adequacy decision where one applies. | 2026-09-22 |
Change log
v1.1.0 effective 2026-10-27
Register columns now cover purpose, data categories, location and transfer safeguard; change notice route added.
- Replaced the DPA column with data categories, location, transfer safeguard and the date each processor was added.
- Added the 30-day change-notice and objection route.
- Published the customer data processing agreement at /legal/dpa.
- Hosting location is stated as EU (Frankfurt).
v1.0.0 effective 2026-09-22
Initial public sub-processor register.
- Published the initial versioned list aligned with the privacy-policy processors (Supabase, Vercel, Stripe, OpenAI, Anthropic, Google Gemini, GitHub, Expo / EAS).
Related: Trust centre · Data processing agreement · Privacy policy