Sub-processors
The vendors below process personal data on our instruction so we can run Lexborn. We have signed (or are signing) Data Processing Agreements with each one. The legal mechanism column documents how we cover transfers of EEA personal data outside the EEA — typically the EU Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914, supplemented by the EU-US Data Privacy Framework where the vendor is certified.
We commit to giving Pro customers 30 days notice before adding any new sub-processor. Customers who require a countersigned DPA can request one — see /legal/dpa.
| Name | Purpose | Region | Data | Transfer mechanism | DPA |
|---|---|---|---|---|---|
| OpenAI, L.L.C. | Voice + text inference (Realtime + Responses APIs) | USA | Audio (in transit), text prompts and completions | EU SCCs (Module 2) + EU-US DPF (vendor-certified) | link |
| Convex, Inc. | Database, file storage, scheduled functions, HTTP routes | USA | Account, transcripts, memory documents, flashcards, level profiles, consent log | EU SCCs (Module 2) | link |
| Clerk, Inc. | Authentication and identity | USA | Email, password hash, JWT claims, optional MFA factors | EU SCCs (Module 2) + EU-US DPF (vendor-certified) | link |
| Polar Software, Inc. | Payments, subscriptions, tax (Merchant of Record) | EU (Sweden) | Email, customer ID, subscription state, payment method (tokenized — never visible to us) | Intra-EEA — no cross-border transfer | link |
| Vercel, Inc. | Web app hosting and CDN | USA (global edge) | Request logs, IP address (transient), build artefacts | EU SCCs (Module 2) + EU-US DPF (vendor-certified) | link |
| PostHog, Inc. (EU) | Product analytics — opt-in, consent-gated | EU (Germany) | Anonymous events; identified events on opt-in (user ID, email) | Intra-EEA — no cross-border transfer | link |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | USA | Stack traces, breadcrumbs (cookies stripped, replays disabled) | EU SCCs (Module 2) + EU-US DPF (vendor-certified) | link |
| Resend, Inc. | Transactional email (DSR exports, billing notices) | USA | Email address, message body (signed export URL) | EU SCCs (Module 2) | link |
Last updated: 2026-05-09. For questions, write to hi@lexborn.app.