Legal
Subprocessors
Last updated: 24 September 2026
These are every third party that may process data on Lucreo's behalf. We keep the list short on purpose: fewer providers means fewer places your data can go.
Current subprocessors
| Provider | Purpose / data processed | Location |
|---|---|---|
| Lovable Cloud (Supabase) | Application hosting, managed PostgreSQL database, authentication and encrypted storage of account, connection and performance data | European Union / United States |
| Stripe, Inc. | Subscription billing and payment processing. Stripe collects and stores payment card details directly; Lucreo never receives them | United States (global processing) |
| Resend, Inc. | Transactional email delivery (password resets, account and billing notifications). Receives email address and message content only | United States |
| Google LLC (Google Ads API) | Source system. Retrieval of the Google Ads reporting data you authorise, plus the one change Lucreo can make — adding a product filter that removes a product you select from a campaign you name. Never bids, budgets, status, targeting or assets | United States (global processing) |
| Shopify Inc. | Source system. Read-only retrieval of products, variants and order line items, plus product status changes you explicitly request | Canada / United States |
| Cloudflare, Inc. | Edge delivery, TLS termination, DDoS protection and request logging | United States (global edge network) |
Our commitments
- Each subprocessor is bound by a written contract with data protection terms no less protective than our DPA.
- Each is engaged for a specific purpose and may not use your data for its own purposes.
- None of these providers uses your data to train generalised AI or machine-learning models.
- Where personal data leaves the EEA, the UK or Switzerland, transfers rely on Standard Contractual Clauses plus encryption in transit and at rest.
- Google and Shopify appear here as source systems: they hold the data you already store with them, and Lucreo reads from them only with your authorisation.
Change notifications
We give at least 30 days' notice before adding or replacing a subprocessor that processes personal data. To be notified by email, write to privacy@lucreo.io with the subject "Subprocessor notifications". Customers may object on reasonable data protection grounds as described in section 6 of the DPA.