Sub-processors
The sub-processors that process personal data about customers' website visitors when Lovelyflows runs the service.
This list is Annex IV to Lovelyflows' data processing agreement. It lists the sub-processors that process personal data about visitors to customers' websites ("End User Data"). Before a sub-processor is added or replaced, Lovelyflows emails customers' contact address at least 14 days in advance, under A3.2 of the agreement.
List
| Sub-processor | Service | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Hosting, file storage, background jobs, AI Gateway | All | EU (Frankfurt); background job bookkeeping in the US, ids only | Standard contractual clauses, EU–US Data Privacy Framework (DPF) |
| Mistral AI | Language models, via Vercel AI Gateway | Conversation content and knowledge excerpts | EU or US | Under Vercel's agreement and standard contractual clauses |
| Embeddings and language models, via Vercel AI Gateway | Conversation content and knowledge excerpts | EU or US | Under Vercel's agreement and standard contractual clauses | |
| Voyage AI | Reranking, via Vercel AI Gateway | Conversation content and knowledge excerpts | US | Under Vercel's agreement and standard contractual clauses |
| TypeSafe | Evaluation model | Conversation content and knowledge excerpts | US | Standard contractual clauses |
| Neon | Database and backups | All stored data | EU (Frankfurt) | No transfer |
| Upstash | Rate limiting | IP address and email address as short-lived keys | EU | No transfer |
| Cloudflare | Real-time delivery of messages to open chats (one room per conversation, nothing stored) | Messages in transit, typing and presence | EU | Standard contractual clauses, DPF |
| Sentry | Error and log monitoring | Error messages, ids and stripped log entries | EU (Frankfurt); account data in the US | Standard contractual clauses, DPF |
| Arcjet | Bot protection | IP address and browser headers | EU or US | Standard contractual clauses |
| Resend | Verification codes to visitors; hand-over emails to the Customer's staff | The visitor's email address; the conversation's title | US | Standard contractual clauses, DPF |
| Firecrawl | Reading the Customer's public web pages into the knowledge base | What appears on the Customer's public pages | US | Processes only public data the Customer points to |