Cookies and similar technologies
We use strictly necessary cookies to ensure platform functionality. With your consent, we may also set analytics cookies. You can change your choice at any time. More in the privacy policy.
This overview lists the service providers named in Annex 3 of our Data Processing Agreement and their respective roles.
LabNote.Light is in Early Access. The agreed DPA governs the use of sub-processors; this overview does not replace it.
| Sub-processor | Service | Processing location | Third-country transfers and safeguards |
|---|---|---|---|
| Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden | Application delivery platform, delivery of system and newsletter emails, AI gateway | EU | Access from third countries, particularly the US, is not excluded; Standard Contractual Clauses |
| Supabase, Inc. (Amazon Web Services data centre, Frankfurt am Main region) | Database, authentication, file storage, server-side functions, backups | Frankfurt am Main | Access from the US is not excluded; Standard Contractual Clauses |
| Resend, Inc., US | Delivery of certain security notifications and alternative email delivery when enabled for other messages | US | Standard Contractual Clauses |
| Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland | Business email inbox for correspondence with the customer | EU | Access from the US is possible; EU-US Data Privacy Framework and Standard Contractual Clauses |
| Google and OpenAI via Lovable's AI gateway | Language models for AI features, only after activation by the customer | US possible | Standard Contractual Clauses |
Depending on the service and feature used, processing covers account and employee data, customer contacts, messages or content entered by the customer. AI features process prompts and the context excerpts submitted for the specific request via the Lovable gateway, not the entire dataset by default. Annex 1 of the DPA describes the data categories and data subjects.
The application database, authentication, files and server-side functions are assigned to Supabase's AWS Frankfurt region. This storage location is not a commitment that every service, AI processing operation or support access takes place exclusively in Germany or the EU.
Google and OpenAI for AI features are accessed through Lovable. AWS is identified here as Supabase's data centre infrastructure, not as an additional direct contractual partner of the customer. Further sub-processors engaged by these providers are listed in their own registers.
The table reproduces the transfer safeguards named in the DPA. Provider information is not evidence of the contracts applicable to LabNote.Light. Current provider DPAs, sub-processor annexes and applicable transfer mechanisms require final review and documentation before a production contract is concluded.
Stripe Payments Europe, Limited processes payment data as an independent controller and is therefore not included in this sub-processor list. Integrations connected by the customer and their recipients are not automatically LabNote.Light sub-processors; their data protection role depends on the relevant agreement.
Under Section 7 of the DPA, we notify the customer's administration by email at least 30 days before introducing or replacing a sub-processor. The customer may object in text form on material data protection grounds within 14 days of receiving the notice. If no agreement is reached within a further 30 days, the customer may terminate the contract effective on the planned introduction date. Updating this page does not replace the contractually agreed notification.
Please send questions about this list, evidence requests and objections to legal@labnote-light.com.
The binding contract is in German; the English overview is provided for information.