Legal
Subprocessors
Last updated
These are the service providers that process personal data on our behalf to run LAVESSO. Each is bound by a contract that requires it to protect the data and use it only to provide its service to us.
Current subprocessors
| Provider | What they do | Data | Location | Privacy |
|---|---|---|---|---|
| Supabase | Database and sign-in (authentication) | Account, organisation, member and role records; usage, credit and billing records; API request records; sign-in sessions | United Kingdom (London region); Supabase is a United States company | Supabase privacy policy |
| Vercel | Hosting of the website, app and API | Everything the website, app and API receive and send while handling a request, and request logs | United Kingdom (London region, lhr1) for our servers; global delivery network; Vercel is a United States company | Vercel privacy policy |
| Google Workspace | Email sending and our support mailbox | Email addresses, names and the content of emails we send and receive | United States and other countries where Google operates | Google Workspace privacy policy |
| Anthropic | AI model processing | The text a business sends for AI processing and the model output | United States and other countries; we do not set a processing region, so processing may take place outside the UK | Anthropic privacy policy |
| Stripe | Card payments for prepaid credit (test mode only today) | Business name, email address, payment amounts and payment status; card details go to Stripe only | United Kingdom, European Union and United States | Stripe privacy policy |
| Sentry | Error reporting, only when switched on | Scrubbed error reports: error type and message, stack trace, request method and path, browser and operating system names. No request bodies, cookies, IP addresses, emails or customer text | European Union (Germany); Sentry is a United States company | Sentry privacy policy |
| Resend | Alert and reminder emails, if used | Recipient email addresses and the content of budget, balance and key reminder emails | European Union (Ireland region); Resend is a United States company | Resend privacy policy |
Transfers outside the UK are protected as our privacy policy describes.
Sign-in providers
If you choose to sign in with Google (or, when available, Apple), that company confirms who you are to us. It acts as an independent controller of the data in your Google or Apple account under its own privacy policy, not as our subprocessor.
Changes to this list
We will update this page before a new subprocessor starts processing personal data for us, and email the owners of business organisations [NOTICE PERIOD FOR NEW SUBPROCESSORS: for example 30 days] beforehand. If you have a reasonable data protection objection to a new subprocessor, tell us at support@lavesso.com before the change takes effect and we will work with you to address it.
Contact
Questions about our subprocessors: support@lavesso.com.