These providers process personal data on our behalf. We engage each under data-processing terms — with one exception, our web host Lovable, explained in the note below — and we notify every customer at least 30 days before adding or replacing one (Data Processing Agreement, section 7).
| Provider | Contracting entity | What it does | Data | Where | Transfer safeguard |
|---|---|---|---|---|---|
| Supabase | Supabase Pte. Ltd., Singapore | Database, authentication, file storage, server functions — all products | All account and customer data | Database and files in the EU (AWS eu-north-1, Stockholm); server functions may run in the region nearest the user; support may be provided from outside the EU | Standard Contractual Clauses in Supabase's data processing addendum |
| Lovable | Lovable Labs AB, Sweden | Building and hosting the web applications | Page requests (IP address, browser data), data shown on server-rendered pages, the application code; where its development tools are connected to our database, data viewed while building and fixing the applications | Global, on Cloudflare's network | None yet — see note below |
| Cloudflare | Cloudflare, Inc., USA — engaged by Lovable and by Supabase, not by us directly | Content delivery and protection, as Lovable's provider and in front of the Supabase API | Page and API requests (IP address, browser data) | Global | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Resend | Plus Five Five, Inc. (Resend), USA | Sending and receiving email | Email addresses, names, message content, delivery logs | Sent from the EU (Ireland); stored in the USA | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Stripe | Stripe Payments Europe, Limited, Ireland | Subscription payments (vox) | Billing contact, organisation, billing address, tax ID, payment details | Ireland, with processing by Stripe, LLC in the USA | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Anthropic | Anthropic Ireland, Limited | AI features: drafting, translation, coaching, answers, and removing personal details from emails forwarded into q | The text each feature needs (see AI transparency) | USA | Standard Contractual Clauses in Anthropic's data processing addendum; no training on our data; standard retention 30 days |
| OpenAI | OpenAI Ireland Ltd | Search in q (embeddings) | The text of questions and knowledge-base entries | USA | Standard Contractual Clauses in OpenAI's data processing addendum; no training on our data; logs kept up to 30 days |
| Hostinger | Hostinger International Ltd | The hello@aeratus.app mailbox | Messages you send us | EU | Within the EU |
Note on Lovable. Lovable publishes a data processing agreement with Standard Contractual Clauses, but includes it only with its Business and Enterprise plans, and our hosting account is not yet on one of them. Until it is, this row has no signed data processing agreement and no transfer safeguard behind it, and the statements in our Privacy Policy, Data Processing Agreement and switching terms that every provider is bound by data-processing terms, and every transfer covered by a safeguard, do not yet hold for Lovable. When the agreement is signed, this note will say so.
Payments and our mailbox. For fraud prevention and its own legal obligations, Stripe acts as an independent controller under its own privacy notice. Stripe and Hostinger mainly process data for which we are the controller (billing, and the correspondence people send us), so for that data they are our processors rather than sub-processors; they are listed here so that this page is complete.
Tools that customers connect themselves — such as Google Analytics, Google Tag Manager, the Meta pixel, WordPress, a Telegram chat for q alerts, or a custom domain — are the customer's own providers, not our sub-processors: the customer chooses them, and data reaches them on its instruction.
Changes
Last change: 2026-10-02 — first published register. We email the administrators of every customer workspace — paid, free or pilot — at least 30 days before a change. Anyone else can ask to be told too: write to hello@aeratus.app and we add you to the notification list.