Legal
Subprocessors
Every third party that processes data on behalf of Lupee, what each one does, and where it runs.
Draft, not yet reviewed by a lawyer
This document was written by the product team and has not been through legal review. It is published here so you can read what is intended, not as a binding agreement. The reviewed version replaces it before the product takes its first payment, and the effective date will say so.
Lupee Subprocessors
Last updated: 13 November 2026
A subprocessor is a third party we use to help run Lupee, which may process personal data in doing so. This page lists all of them, what they do, what data they can see, and where they run.
We give at least 30 days' notice before adding or replacing a subprocessor. To be notified, subscribe at https://lupee.app/subprocessors or email [OWNER TO CONFIRM: privacy contact mailbox, proposed privacy@lupee.app]. Business customers can object on reasonable data protection grounds under section 6.3 of the Data Processing Addendum.
How to read the "data" column
- Message content means the text of messages from channels you have enabled.
This is the most sensitive category. Only three kinds of vendor touch it: the model provider, our hosting and database, and our queue.
- Derived data means extracted commitments and their metadata.
- Account data means your email, name, identifiers and settings.
- Billing metadata means plan, amount, currency, country, invoice state. It
does not mean card numbers, which we never hold.
- Diagnostics means errors, crashes, performance traces and server logs.
Core infrastructure
| Subprocessor | Purpose | Data it can process | Region | Notes |
|---|---|---|---|---|
| Anthropic, PBC (US) | Large language model API. Extracts commitments from message text using Claude models. | Message content, message metadata (sender display name, timestamps), derived data | United States. Verify before publishing whether any non-US region is available to you and which one you use. | Under the commercial API terms, inputs and outputs are not used to train the provider's models. The provider retains inputs and outputs for a limited period for trust, safety and legal compliance. Verify the current retention period and state it here. Confirm whether you have zero data retention enabled. |
| Fly.io, Inc. (US) | Hosting for the API service and background workers. | Message content in transit and in process memory, derived data, account data, diagnostics | Region you deploy to. Verify before publishing and name the actual regions. | Compute only. Persistent data lives in the database provider. |
| Neon, Inc. (US) | Managed PostgreSQL. The primary database. | Message content, message metadata, derived data, account data, connection records including encrypted platform tokens, billing metadata | Region you provision. Verify before publishing. EU regions are offered by the vendor; confirm which one you use. | Encrypted at rest by the provider. Backups held in the same region. |
| Upstash, Inc. (US) | Managed Redis. Job queue for ingestion and extraction. | Message content transiently while a job is queued, derived data, job metadata | Region you provision. Verify before publishing. | Queue payloads are short-lived. Confirm the actual TTL on completed jobs. |
| Cloudflare, Inc. (US) | DNS, CDN, WAF, DDoS protection. Cloudflare R2 for object storage if used. | Request metadata including IP address and user agent for traffic to our endpoints. R2 would hold exports and other blobs. | Global edge network. R2 bucket region as configured. Verify before publishing, and verify whether R2 is used at launch at all. | Edge processing is global by design. If you need EU-only handling, check Cloudflare's regional services options. |
| Vercel Inc. (US) | Hosting for the marketing site at https://lupee.app. | Request metadata, and analytics data from the website if enabled | Global edge, primary region as configured. Verify before publishing. | Does not touch message content. |
Payments and subscriptions
| Subprocessor | Purpose | Data it can process | Region | Notes |
|---|---|---|---|---|
| Stripe, Inc. (US) and Stripe Payments Europe, Ltd (Ireland) | Payment processing, invoicing and tax calculation for web purchases. | Name, email, billing address, payment method, transaction and invoice records, country, tax identifiers, IP address for fraud checks | United States and Ireland. Verify before publishing which entity contracts with you. | Stripe is an independent controller for parts of its processing, including fraud prevention and regulatory compliance. We never receive full card numbers. |
| RevenueCat, Inc. (US) | Mobile subscription infrastructure. Validates App Store and Google Play receipts and manages entitlements. | An app user identifier, store transaction and entitlement records, device and platform metadata, country | United States. Verify before publishing. | Does not process card details. Purchases themselves are handled by Apple or Google. |
| Apple Inc. (US) | App Store purchases and Sign in with Apple. | Purchase and subscription records, Apple account identifier, and your email or Apple private relay address if you use Sign in with Apple | United States and Apple's global infrastructure | Apple is an independent controller for App Store transactions and for the Apple ID. Its own privacy policy applies to those. Do not describe Apple as our processor for this. |
| Google LLC (US) | Google Play purchases and Google sign-in. | Purchase and subscription records, Google account identifier, email, name and avatar if you use Google sign-in | United States and Google's global infrastructure | Google is an independent controller for Play transactions and for the Google account. |
Notifications and messaging
| Subprocessor | Purpose | Data it can process | Region | Notes |
|---|---|---|---|---|
| Apple Inc., Apple Push Notification service (US) | Delivery of push notifications to iOS devices. | Device push token and the notification payload | United States and Apple's global infrastructure | Verify before publishing whether your notification payloads contain message or commitment text. If they do, say so plainly here, because Apple sees the payload. |
| Google LLC, Firebase Cloud Messaging (US) | Delivery of push notifications to Android devices. | Device push token and the notification payload | United States | Same verification point as above. |
| Expo (650 Industries, Inc.) (US) | Push notification delivery service that fronts APNs and FCM for the Expo app. | Device push token and the notification payload | United States. Verify before publishing. | You can send directly to APNs and FCM instead. If you do, delete this row. |
| Email delivery provider | Transactional email: sign-in one-time codes, billing receipts, daily briefs, and product notices. | Email address, name, and the content of the message, which for the daily brief includes commitment text | To be named before publishing. | Not specified in the product spec, but required by the email one-time code sign-in flow. Choose the vendor, sign its DPA, and complete this row. |
Observability
| Subprocessor | Purpose | Data it can process | Region | Notes |
|---|---|---|---|---|
| Functional Software, Inc. dba Sentry (US) | Crash and error reporting for the API, web and mobile apps. | Error and crash records, stack traces, app and device metadata, an account identifier, IP address, and any data fragment incidentally captured in an error | United States, or the EU instance. Verify before publishing which instance you use. Sentry offers an EU region; using it is the better choice for EU customers. | We configure scrubbing of known sensitive fields. Scrubbing is best effort. Message content should not appear in errors but can appear in a stack trace. |
| Grafana Labs (US, with EU regions) | Metrics, traces and logs via OpenTelemetry. | Operational telemetry. May include an account or tenant identifier in trace attributes and IP addresses in access logs. | Region as configured. Verify before publishing. | Verify whether personal data reaches this vendor at all in your configuration. If traces carry only opaque identifiers and no personal data, say so and note it here. |
Platforms you connect to
These are not our subprocessors. They are services you already use, and you have your own relationship with them. We call their APIs on your behalf under the permissions you grant.
- Slack Technologies, LLC
- Discord Inc.
- Telegram Messenger Inc.
Their handling of your data is governed by their own terms and privacy policies.
What their terms require of us, because it changes what we can offer you and you should not have to read their developer documentation to find out:
- Slack permits only limited and temporary storage of another organisation's
data, prohibits persistent copies, archives, indexes and long-term data stores, prohibits using API data to train a large language model, and bars bulk export of message content except under a separate agreement. Where Slack's limit is shorter than the retention window you have chosen, Slack's limit applies to your Slack data.
- Discord prohibits using message content obtained through its APIs to train
machine learning or AI models, including large language models, without its express written permission, and restricts retention of message content to what is necessary. It also requires us to notify Discord, as well as you, about unauthorised access to data obtained through its APIs.
- Telegram shows a bot only the messages addressed to it in a group chat,
unless a group administrator turns privacy mode off. That is a limit on what we can see rather than on what we may keep.
The prohibition on training is the reason our agreement with the AI provider matters as much as it does. It is not only a promise we make to you: it is how we satisfy two platform contracts at the same time.
Platforms we do not support, and will not
Recorded here so that the answer does not have to be found again every quarter.
- Personal WhatsApp. No API exists. Anything that appears to offer it is
breaching WhatsApp's terms, and we will not.
- WhatsApp Business. Meta's terms restrict AI providers from the platform
where AI is the primary rather than an incidental function of the service, at Meta's sole discretion. We are an AI product. Not supported until Meta answers that in writing.
- LinkedIn. No third-party read access to messages, and cache rules that
allow a member's profile data to be held for 24 hours and their activity for
- An ordinary database and an ordinary nightly backup both breach that. This
is permanent.
- TikTok direct messages and Instagram or Facebook personal profiles. No
API exists for either.
Verification status
Every row above marked "verify before publishing" is inferred from the product's technical stack rather than confirmed against a signed agreement. This page must not be published until each of those is checked, the vendor's data processing agreement is in place, and the transfer mechanism is recorded.
Questions: [OWNER TO CONFIRM: privacy contact mailbox, proposed privacy@lupee.app].