Last updated: October 2026
GDPR · UK GDPRCCPA / CPRASCCs Modules 2 & 3
| Subprocessor | Purpose | Data categories | Region | Agreement |
|---|---|---|---|---|
| Supabase (Lovable Cloud) | Application database, auth, storage | Account, workspace, contact records | EU / US (region-pinned per workspace) | Standard DPA + SCCs |
| Cloudflare Workers | Application runtime + CDN | HTTP request metadata, encrypted payloads | Global edge | Cloudflare DPA + SCCs |
| Stripe | Payments, subscriptions, invoices | Billing contact, card token, invoices | US / IE | Stripe DPA + SCCs |
| Firecrawl | Public web crawling for enrichment | Search queries, public web content | US | Firecrawl DPA |
| Google (Gemini via Lovable AI Gateway) | AI extraction + scoring | Prompt context (no PII inputs by default) | US | Google Cloud DPA + SCCs |
| Resend (transactional email) | Outbound transactional email | Recipient email, subject, body | US / EU | Resend DPA + SCCs |
| PostHog (product analytics) | Product usage analytics | Pseudonymous events, IP (truncated) | US / EU (configurable) | PostHog DPA + SCCs |
Change notification
We post material additions or replacements here at least 30 days in advance. Subscribe to notifications by emailing legal@coreforgedata.com.
Object to a subprocessor
Customers with an executed DPA may object in writing within 30 days. If we can't resolve the objection, you may terminate the affected service for convenience.