Current list
| Sub-processor | Purpose | Data | Location | Safeguard |
|---|---|---|---|---|
| Lovable Cloud (Supabase) | Application database, authentication, file storage. | Account data, business data, usage metadata. | EU (Frankfurt) | DPA + EU hosting |
| Cloudflare, Inc. | Edge runtime, CDN, DDoS protection. | Request metadata, IP address. | Global edge, EU points of presence | SCCs + DPA |
| Paddle.com Market Limited | Payment processing as Merchant of Record. Tax handling and invoicing. | Name, email, billing address, payment method, transaction history. | EU / UK / US | SCCs + Paddle DPA |
| OpenAI, L.L.C. | AI engine probes (ChatGPT) initiated by the Customer. | Prompts submitted by Customer (no PII by default). | US | SCCs + zero-retention API |
| Anthropic PBC | AI engine probes (Claude) initiated by the Customer. | Prompts submitted by Customer. | US | SCCs |
| Google LLC (Gemini API) | AI engine probes (Gemini) initiated by the Customer. | Prompts submitted by Customer. | US / EU | SCCs |
| Perplexity AI, Inc. | AI engine probes (Perplexity) initiated by the Customer. | Prompts submitted by Customer. | US | SCCs |
| Brevo (Sendinblue) | Transactional and marketing email. | Name, email, message metadata. | EU (France) | DPA + EU hosting |
Subscribe to change notifications
Email privacy@foundin.ai with the subject "Subscribe: sub-processor updates" and we'll add you to the change log.