Governance
Sub-processor register
The complete list of third-party services that process personal data on behalf of AsifDevX, including their role, purpose and Data Processing Agreement (DPA). Updates to this list are versioned in our public repository.
Last updated: 2026-07-18
Supabase (via Lovable Cloud)
- Role
- Processor
- Purpose
- Primary database, authentication, object storage
- Data processed
- All application data: profiles, leads, testimonials, CRM records, audit logs
- Location
- EU / US regions
Cloudflare
- Role
- Infrastructure
- Purpose
- Edge network, TLS termination, DDoS mitigation, CDN
- Data processed
- HTTP request metadata, IP address (transit only)
- Location
- Global anycast
Lovable AI Gateway
- Role
- Processor
- Purpose
- AI request routing, rate limiting, telemetry
- Data processed
- Prompt payloads in transit. PII is redacted server-side before dispatch
- Location
- Managed platform
Google (Gemini API)
- Role
- Sub-processor
- Purpose
- Large-language-model inference for in-app AI features
- Data processed
- Redacted prompts + generated completions. Not used to train Google's general models
- Location
- US / EU (Google Cloud)
Resend
- Role
- Processor
- Purpose
- Transactional email delivery (auth, receipts, notifications)
- Data processed
- Recipient email address, message subject and body
- Location
- US
| Vendor | Role | Purpose | Data processed | Location | DPA |
|---|---|---|---|---|---|
| Supabase (via Lovable Cloud) | Processor | Primary database, authentication, object storage | All application data: profiles, leads, testimonials, CRM records, audit logs | EU / US regions | View DPA |
| Cloudflare | Infrastructure | Edge network, TLS termination, DDoS mitigation, CDN | HTTP request metadata, IP address (transit only) | Global anycast | View DPA |
| Lovable AI Gateway | Processor | AI request routing, rate limiting, telemetry | Prompt payloads in transit. PII is redacted server-side before dispatch | Managed platform | View DPA |
| Google (Gemini API) | Sub-processor | Large-language-model inference for in-app AI features | Redacted prompts + generated completions. Not used to train Google's general models | US / EU (Google Cloud) | View DPA |
| Resend | Processor | Transactional email delivery (auth, receipts, notifications) | Recipient email address, message subject and body | US | View DPA |
Change notifications
We commit to updating this register at least 30 days before adding a new sub-processor that materially changes the data flow. Historical changes are visible in the commit history of src/routes/sub-processors.tsx. For full context see our privacy policy.