Service Provider and Transfer Schedule
Publication draft — do not present this as a completed subprocessor list.
Operator: Szegi Roland Attila E.V. Contact: hello@dropsite.hu.
| Service | Purpose and data | Role / required confirmation |
|---|---|---|
| Lovable project hosting and its actual database/storage chain | Website, backend requests, account records, encrypted connector credentials and conversations; technical metadata | Hosting processors and any subprocessors: confirm contractual legal entities, DPA, hosting/backup regions, support access and transfers. “Lovable” or “Supabase-compatible database” alone is insufficient |
| Cloudflare | Observed website delivery/security and bot-management cookie; request metadata | Confirm whether contracted directly or through the host, exact products, entity, DPA, locations and transfer terms |
| Account identity and user-authorised Gmail/Drive/Calendar API content | Connected provider with its own responsibilities and account terms; distinguish provider API operation from hosting subprocessing | |
| ClickUp | User-authorised workspace/task content and OAuth authorisation | Connected provider with its own responsibilities; confirm the actual developer agreement and data flow |
| User-selected AI API provider, including Anthropic where selected | Task instructions, conversation context and retrieved material needed for processing | Role depends on contracts and instructions; verify provider entity, training restrictions, retention, region and transfer terms for each supported endpoint |
| Polar | Purchase, billing, payment status, fraud/tax records and subscription references | Merchant of Record/reseller; own privacy responsibilities for sale-related processing. Assess any separate processor services under its actual DPA |
| Support email service | Support messages and attachments | Identify the actual mail host, legal entity, DPA, locations and retention; the email domain does not identify the service provider |
[PUBLISH-05 / PUBLISH-15: replace this table with the completed entity-level schedule and confirm contracts. Record locations, transfer mechanism and links to provider notices. Do not claim EU-only storage, universal SCC coverage, zero retention or that every recipient is a subprocessor.]
Business customers must receive the specific authorised subprocessor schedule applicable to their DPA, including processing location and duties. Direct services that customers connect themselves are not automatically our subprocessors. Material changes to authorised subprocessors must follow the agreed notice and objection procedure.