Service Provider and Transfer Schedule
Effective date: 16 September 2026. This schedule lists the recipients actually used. Where a contractual detail rests on a provider's published terms rather than a separately negotiated agreement, we say so.
Operator: Szegi Roland Attila E.V. Contact: hello@dropsite.hu.
| Service | Purpose and data | Role and basis |
|---|---|---|
| Lovable application platform, including its managed database and storage | Website, backend requests, account records, encrypted connector credentials and conversations; technical metadata | Hosting and database processor under the platform's published data-protection terms. Database and stored data in the European Union (Ireland, eu-west-1); platform support access is possible. No separately negotiated agreement |
| Cloudflare | Website and backend delivery, security and bot management; request metadata and a security cookie | Edge delivery and security, used through the hosting platform rather than a direct contract of ours. Global routing, so processing outside the EEA is possible |
| Account identity and user-authorised Gmail, Drive, Calendar, Analytics and Search Console API content. Analytics is read-only; Search Console is read-only and ordinarily delayed by 2–3 days | Connected provider with its own responsibilities and account terms; distinguish provider API operation from hosting subprocessing | |
| ClickUp | User-authorised workspace/task content and OAuth authorisation | Connected provider with its own responsibilities; confirm the actual developer agreement and data flow |
| GitHub | User-authorised profile/email and public or private repository content. The repo scope permits reads and writes, including repository, file/commit, issue and pull-request creation | Connected provider with its own responsibilities and account terms; provider-level access is broader than the extension's operation-by-operation controls |
| User-selected custom HTTPS/OpenAPI API or remote HTTPS MCP server | Endpoint URL, schema/tool metadata, encrypted credential, task arguments and results sent when the user runs that connector | Recipient selected and instructed by the user. We do not appoint, identify or control the endpoint and cannot promise its location, retention or transfer safeguards; it is not automatically our subprocessor |
| User-selected AI API provider, including Anthropic where selected | Task instructions, conversation context and retrieved material needed for processing | Role depends on contracts and instructions; verify provider entity, training restrictions, retention, region and transfer terms for each supported endpoint |
| Polar | Purchase, billing, payment status, fraud/tax records and subscription references | Merchant of Record/reseller; own privacy responsibilities for sale-related processing. Assess any separate processor services under its actual DPA |
| Support email service for hello@dropsite.hu | Support messages and attachments | Business mailbox provider acting under its own or contracted terms. The provider identity must be supplied in a customer-specific DPA before signature if support email will process that customer's personal data |
Locations and safeguards. The database and stored conversation and credential data are hosted in the European Union (Ireland, eu-west-1). Website and backend requests pass through a global edge network, so request routing and security processing can take place outside the EEA. Google, ClickUp, GitHub, your chosen AI provider and any custom connector endpoint process data in the regions set by their own terms. We rely on the data-protection terms and standard contractual clauses published by applicable providers; we have not negotiated bespoke agreements, we do not claim EU-only storage for every step, universal SCC coverage, zero retention at your AI provider, or that every recipient is our subprocessor. A user-selected custom endpoint may offer no GDPR transfer mechanism; do not send personal data to it unless you have verified the endpoint and lawful transfer basis. Support email sent to hello@dropsite.hu is received in the operator's business mailbox at its email/domain provider.
Business customers must receive the specific authorised subprocessor schedule applicable to their DPA, including processing location and duties. Direct services that customers connect themselves are not automatically our subprocessors. Material changes to authorised subprocessors must follow the agreed notice and objection procedure.