Sub-processors
Last updated: 10 October 2026
Provided by Inverge. Contact: cdkraan@gmail.com.
| Service | Purpose | Data | Location | Used |
|---|---|---|---|---|
| Lovable Cloud | App hosting, database, sign-in and file storage; underlying vendors to be confirmed | Workspace and account data | Region and transfer safeguards to be confirmed — unverified | Always |
| Cloudflare | Serving the app and website snippet, network security | Request data, IP addresses | Global — unverified | Always |
| Lovable AI and selected model providers | AI drafting, summaries, chat answers and images; provider routing to be confirmed | Prompts, relevant Knowledge, text and images sent to AI features; provider retention/training terms to be confirmed | Processing locations and safeguards to be confirmed — unverified | When AI features are used |
| Paddle | Payments, invoicing and tax (merchant of record) | Billing name, email, payment details | UK / EU — unverified | Paid plans |
| Unipile | Connecting LinkedIn, email and messaging accounts | Messages and contacts on connected channels | EU — unverified | When you connect a channel |
| Firecrawl | Website checks and live AI search | Public website content | US — unverified | When you run checks |
| Google APIs | Search Console, Analytics and Business Profile data | Your site's search, traffic and review data | US — unverified | Only if you connect them |
| Slack | Alerts you choose to receive | Alert text (lead name, short summary) | US — unverified | Only if you connect it |
| Your CRM (HubSpot, Salesforce, Pipedrive, Zoho, monday.com) | Sync of leads and deals | Prospect and deal details | Per provider — unverified | Only if you connect it |
Provider status and verification
This is a preliminary service inventory, not a confirmed contractual sub-processor register. Locations shown below are indicative provider locations, not verified storage or processing regions. DPF certification, executed SCCs, legal entity names and contracts must be checked individually; no transfer safeguard is asserted by this draft.
Payment providers acting as merchant of record may be independent controllers. Google, Slack and CRM services connected by customers may act as separate controllers or the customer's processors rather than Inverge sub-processors. Their roles depend on the service and contract and require confirmation.
Changes to this list
The draft DPA proposes 30 days' notice of new sub-processors and a right to object on data protection grounds. The notification procedure and final register must be confirmed before contractual acceptance.
Questions: cdkraan@gmail.com.