Subprocessors
The service providers that process personal data on our behalf. Last updated 25 August 2026.
A subprocessor is a third party we engage that processes personal data on our behalf in order to deliver the Service. Each one is bound by a written agreement no less protective than our own commitments to you, and each processes data only to provide its service to us.
| Provider | Purpose | Data processed | Entity location |
|---|---|---|---|
| Supabase | Database and authentication | Account data, customer business data, website visitor data | United States |
| Vercel | Application hosting and tag ingest | Account data, customer business data, website visitor data | United States |
| Stripe | Payments and subscriptions | Billing contact and payment data | United States |
| Resend | Transactional and report email | Recipient name and email address | United States |
| Twilio | SMS delivery, for customers who opt in | Recipient mobile number | United States |
| PostHog | Product analytics for our own application only — never deployed on customer websites | Account data and in-app usage events | United States |
| Sentry | Error monitoring for our own application | Diagnostic data, which may incidentally include an account identifier | United States |
| Google (Places / Business Profile APIs) | Business identity, location, and public review data | Publicly listed business information and public review content | United States |
Vendors that are not subprocessors
Two categories of third party receive data from us but are not subprocessors, because what we send them contains no personal data:
- Large language model providers. To measure visibility we send questions about businesses and geographies — for example, “best Toyota dealer near Claremont”. These queries never include personal information about you, your staff, or visitors to your website.
- Licensed market-data providers. We license aggregated data about the questions people ask AI systems and how those systems answer. This data is aggregate and contains no personal information.
Our Data Processing Addendum states the same boundary for Website Visitor Data specifically: AI engine providers never receive it.
Changes to this list
We will notify customers by email or in-app notice before adding or replacing a subprocessor, and you may raise a reasonable objection. See section 3 of the DPA.
Questions about a specific provider: privacy@lumon8.ai.