Last Updated: August 30, 2026
Growtheon uses third-party service providers ("subprocessors") to help provide the platform. This page is the current public register of subprocessors that may process customer personal data in connection with the Growtheon platform, together with the purpose of that processing, the contracting entity where the vendor documents it, and the transfer mechanism the vendor publicly states.
Which subprocessors apply to a given account depends on the features and integrations that customer enables. Some providers are only involved when a customer chooses to use the related functionality, for example messaging or AI-assisted features. Integrations a customer connects themselves are governed by that customer's own agreement with the third party.
Entries marked Not verified are facts that could not be confirmed from the vendor's own published documentation at the date above. They are shown as unverified rather than assumed.
This register is referenced by the Data Processing Addendum. As described in Section 7 of the DPA, customers are informed of intended additions or replacements of subprocessors before the change becomes effective, by account email, in-product notice, or another reasonable electronic communication method — this page is the register, not the sole notice mechanism. To raise a data-protection objection, contact privacy@growtheon.co.
| Subprocessor and entity | Purpose of processing | Processing locations | Vendor DPA | Transfer mechanism |
|---|---|---|---|---|
| SupabaseSupabase Pte. Ltd.Supabase DPASupabase subprocessor listSupabase regions | Managed Postgres database, authentication, storage, and serverless functions for the Growtheon platform. Processes the customer records, contacts, messages, and account data stored in the platform. | Region is selected per project. The Growtheon platform project's serverless functions are served from the eu-central-1 (Frankfurt) region; the Postgres region for that project is Not verified from public sources. Supabase runs on Amazon Web Services and publishes its own subprocessor list. | Published | Standard Contractual Clauses per Supabase's DPA transfer terms. Data Privacy Framework participation: Not verified. |
| CloudflareCloudflare, Inc.Cloudflare customer DPACloudflare subprocessorsDPF participant record | Edge network, DNS, and CDN in front of Growtheon web properties and the platform API gateway. Processes request metadata, including IP addresses, in transit. | Global anycast edge network. Specific region controls (Data Localization Suite) are offered by Cloudflare; whether they are enabled for Growtheon is Not verified. | Published | Standard Contractual Clauses per Cloudflare's customer DPA. Cloudflare, Inc. is a listed EU-U.S. Data Privacy Framework participant. |
| VercelVercel, Inc.Vercel DPAVercel DPF statement | Application hosting and serverless rendering for the Growtheon application front end. Processes request data in transit. | Not verified — Vercel does not publish a data-residency or region page for this service. Requests to the Growtheon application have been observed served from Vercel's London (lhr1) region. | Published | Vercel states it is certified under the Data Privacy Framework; Standard Contractual Clauses are available under its DPA. |
| LovableLovable Labs IncorporatedLovable DPALovable subprocessors | Development and hosting platform for Growtheon web properties, client-side error reporting, and the AI gateway used to route model traffic (see AI features). | Not verified — no public data-residency or region disclosure was located. | Published, stated by the vendor as available on Business and Enterprise plans. | Not verified — no public Standard Contractual Clauses or Data Privacy Framework statement was located. |
| Subprocessor and entity | Purpose of processing | Processing locations | Vendor DPA | Transfer mechanism |
|---|---|---|---|---|
| StripeStripe, LLC (accounts in the Americas) or Stripe Payments Europe, Limited (accounts elsewhere), per Stripe's DPA.Stripe DPAStripe DPF statement | Subscription billing, checkout, and payment processing for Growtheon accounts, including billing contact and payment details. | Not verified — Stripe does not publish a data-residency map for these services. | Published | Standard Contractual Clauses referenced in Stripe's DPA. Stripe states that Stripe, LLC self-certifies under the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework. |
| PaddlePaddle.com Market Ltd (United Kingdom)Paddle DPAPaddle GDPR page | Checkout and subscription billing where the Paddle checkout path is used, including billing contact details. Paddle acts as merchant of record on that path. | Not verified — Paddle does not publish server or data-centre locations on its legal pages. | Published | Standard Contractual Clauses referenced in Paddle's DPA. Transfers to the United Kingdom are additionally covered by the European Commission's UK adequacy decision. Data Privacy Framework participation: not applicable / Not verified. |
| PayPalNot verified. | PayPal hosted-button script is loaded on Growtheon marketing pages, so PayPal may process payment and device data for visitors who use that path. | Not verified. | Not verified. | Not verified. |
| Subprocessor and entity | Purpose of processing | Processing locations | Vendor DPA | Transfer mechanism |
|---|---|---|---|---|
| TwilioTwilio Inc.Twilio DPATwilio subprocessorsDPF participant record | Delivery of SMS, voice calls, call recording, and related telephony features, including recipient phone numbers and the message or call content a customer sends. | Not verified as a single storage location; Twilio publishes a subprocessor list identifying its own subprocessors and their countries. | Published | Standard Contractual Clauses per Twilio's data protection addendum. Twilio Inc. is listed on the Data Privacy Framework participant register. |
| ResendPlus Five Five, Inc. (trading as Resend)Resend DPAResend regionsResend subprocessors | Delivery of platform, transactional, and notification email, including recipient email addresses and message content. | Resend documents selectable sending regions: N. Virginia (us-east-1), Ireland (eu-west-1), São Paulo (sa-east-1), and Tokyo (ap-northeast-1). The region configured for Growtheon is Not verified from public sources. | Published | Standard Contractual Clauses attached to Resend's DPA. Data Privacy Framework participation: Not verified. |
| SendGridSendGrid, Inc. (a Twilio company)Twilio DPA (covers SendGrid)DPF participant record (Twilio Inc.) | Alternative email delivery path, used only where a workspace has configured SendGrid or where SendGrid is configured as the platform email sender. | Not verified. | Covered by Twilio's data protection addendum. A separate current SendGrid-hosted DPA URL is Not verified. | Standard Contractual Clauses per Twilio's data protection addendum. SendGrid appears as a covered entity under Twilio Inc.'s Data Privacy Framework record; independent confirmation of SendGrid's own current listing is Not verified. |
| Subprocessor and entity | Purpose of processing | Processing locations | Vendor DPA | Transfer mechanism |
|---|---|---|---|---|
| Lovable AI GatewayLovable Labs IncorporatedLovable DPALovable subprocessors | Routes prompt content for most AI-assisted features to the selected model provider, including Google Gemini models. Prompt content passes through the gateway. | Not verified. | Published, stated by the vendor as available on Business and Enterprise plans. | Not verified. Onward processor for gateway traffic: Google (Gemini models), listed below. |
| Google (Gemini models)Google LLC, per the Gemini API terms.Gemini API termsGoogle Cloud DPADPF participant record | Processes prompt content for AI-assisted features routed to a Gemini model. Reached through the Lovable AI Gateway rather than contracted directly by Growtheon. | Not verified for the Gemini developer API; Google does not document selectable data residency for that API (data residency is documented for Vertex AI, which Growtheon does not use). | Google's Cloud Data Processing Addendum is published; its applicability to the Gemini developer API specifically is Not verified. | Google LLC is an active EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. participant, and documents Standard Contractual Clauses where the framework does not apply. |
| OpenAIOpenAI OpCo, LLC, or OpenAI Ireland Ltd. for customers established in the EEA or Switzerland, per OpenAI's DPA.OpenAI DPAAPI data residencyAPI data usage default | Processes content sent to OpenAI models for speech-to-text, text-to-speech, and assistant features that are routed to OpenAI directly. | United States by default. OpenAI documents optional regional data residency, including Europe, for eligible API products; whether it is enabled for Growtheon is Not verified. | Published | Standard Contractual Clauses per OpenAI's DPA. Data Privacy Framework participation: Not verified. |
| AnthropicAnthropic, PBC, or Anthropic Ireland, Limited for customers established in the EEA, Switzerland, or the UK, per Anthropic's terms.Anthropic DPAAnthropic DPA incorporationTraining default | Processes prompt content for AI assistant features routed to an Anthropic (Claude) model. | Not verified — Anthropic does not document selectable API regions. | Published, and stated by the vendor as incorporated into its commercial terms. | EU Standard Contractual Clauses incorporated into Anthropic's DPA. Data Privacy Framework participation: Not verified. |
| Subprocessor and entity | Purpose of processing | Processing locations | Vendor DPA | Transfer mechanism |
|---|---|---|---|---|
| PostHogPostHog, Inc.PostHog DPAPostHog subprocessors | Product and website analytics for Growtheon's own marketing website, including usage events and device or IP-derived metadata. | Growtheon's configuration sends events to PostHog Cloud US (us.i.posthog.com). PostHog also offers PostHog Cloud EU. | Published, generated and countersigned through the PostHog account. | Not verified — no Data Privacy Framework listing or Standard Contractual Clauses statement was confirmed on PostHog's own pages beyond the DPA itself. |
| Meta PlatformsMeta Platforms Ireland Limited for EEA, Swiss, and UK users, with onward transfer to Meta Platforms, Inc. per Meta's European data transfer addendum.Meta data processing termsMeta EU data transfer addendumDPF participant record | Advertising measurement for Growtheon's own marketing website through the Meta Pixel and Conversions API. No customer CRM records are sent. | Not applicable as a hosting location; processed on Meta infrastructure. | Published (Meta data processing terms). | Meta Platforms, Inc. is an active EU-U.S. and Swiss-U.S. Data Privacy Framework participant; Meta's European data transfer addendum also references Standard Contractual Clauses. |
| Google (Tag Manager and Ads)Google LLC, with the contracting entity varying by product and region per Google's data processing terms.Google Ads data processing termsGoogle transfer frameworksDPF participant record | Tag management and advertising measurement for Growtheon's own marketing website. No customer CRM records are sent. | Google states processing may occur on servers in multiple countries; no region selection is documented for these products. | Published (Google Ads data processing terms, which apply to Tag Manager). | Google LLC is an active EU-U.S. Data Privacy Framework and UK Extension participant, and documents Standard Contractual Clauses where the framework does not apply. |
Growtheon LLC is established in the United States. Where a vendor states not verified transfer information, no transfer mechanism is asserted on that vendor's behalf. International transfers are addressed in Section 12 of the Data Processing Addendum.