To provide Lavesy we use carefully selected service providers. Data processing agreements (DPAs) are in place with all external providers. This page is the list under clause 6 of our data processing agreement .
Last updated: 2026-10-22
Subprocessors
These service providers process our customers' personal data on their behalf (Art. 28(2) and (4) GDPR, DPA clause 6).
| Provider | Purpose | Processing location | DPA |
|---|---|---|---|
| Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Zypern | Server hosting & operation of the application (VPS) including database, file storage and backups; sending emails through the Lavesy sending route | EU – data centre in Germany (Frankfurt am Main); for email and network services Hostinger engages further processors, some in the USA (standard contractual clauses) Further processors: Appendix 3 of the Hostinger DPA | View DPA |
Self-hosted services
We run this software ourselves on our server; no further service provider is involved.
| Provider | Purpose | Processing location | DPA |
|---|---|---|---|
| GlitchTip (selbst gehostet) | Error tracking for technical fault analysis (part of the processing on behalf) | EU (on our server at Hostinger, Germany) | Own infrastructure – no external processor |
| Umami (selbst gehostet) | Cookieless website analytics; on the public pages also masked session recordings & heatmaps (30 days) – no disclosure to third parties | EU (on our server at Hostinger, Germany) | Own infrastructure – no external processor |
| Quackback (selbst gehostet) | Feedback function (product feedback and feature requests) – no disclosure to third parties | EU (on our server at Hostinger, Germany) | Own infrastructure – no external processor |
Service providers for Lavesy's own purposes
Lavesy itself is the controller for this processing (for example billing our plans); it is not part of the processing on behalf of customers.
| Provider | Purpose | Processing location | DPA |
|---|---|---|---|
| Stripe Payments Europe, Ltd. | Payment processing & billing of the paid plans (Lavesy itself is the controller for this) | EU (Ireland), transfer to the USA possible | View DPA |
Services connected by the customer (optional)
A customer only uses these services if it activates them itself and stores its own access. They are not subprocessors of Lavesy; the contract is between the customer and the service (DPA clause 10). The same applies to an own email account, messaging channels, own backup storage and AI applications connected through the MCP interface.
| Provider | Purpose | Processing location | DPA |
|---|---|---|---|
| OpenAI, L.L.C. (optional) | AI-assisted extraction of document data and AI assistant – only if a tenant activates the function and stores its own API key | USA (standard contractual clauses) | View DPA |
| Anthropic, PBC (optional) | AI-assisted extraction of document data and AI assistant – only if a tenant activates the function and stores its own API key | USA (standard contractual clauses) | View DPA |
Changes and objection
We announce new or replaced subprocessors at least four weeks before they are used — by email to the administrators of every customer company and here on this page. Customers may object to the change in text form on objective data protection grounds until the period expires; details are set out in clause 6 of the DPA .
No changes are currently announced.
More information about how your data is processed is available in our privacy policy.