Subprocessors
Last updated: 8 October 2026
These are the third-party providers FlowOps uses to deliver the service and that may process personal data on our behalf. Where a processing location has not been verified we say so rather than guess. Questions: hello@flowops.it.com.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Lovable Cloud (infrastructure on Supabase / Amazon Web Services) | Application hosting, database, sign-in and file storage | Account details, workspace content (projects, tasks, clients, CRM, finance records), uploaded files, logs | Database, sign-in and storage: EU (AWS eu-north-1, Stockholm). Application servers: global edge network. |
| Paddle.com | Merchant of Record — checkout, payments, invoicing and tax | Buyer name, billing email, country, tax details, payment and subscription status. Card details go to Paddle only. | Determined by Paddle — see Paddle's privacy notice. |
| Lovable (managed email delivery) | Sending account and notification emails | Recipient email address, first name, email content such as invitation, password-reset and billing notices | Not independently verified. |
| Google (Google Analytics 4) | Optional product usage analytics — only after consent | Pseudonymous browser identifier, page paths with record IDs removed, simple feature events. No names, emails or workspace content. | Determined by Google — not independently verified. |
| Lovable AI Gateway (model provider: OpenAI) | Optional AI billing-consistency review run by a workspace Administrator | Billing event summaries, subscription and receipt details (amounts, plan names, statuses). No card data. | Not independently verified. |
See also our Privacy Notice and Security & Trust page.