# Providers and subprocessors

Version: 1.0.4 - Effective: 21 October 2026

Luca is built by SetLuca, LLC. Like most software, it runs on services from other companies. This page lists every one of them, what each one does for Luca, what data it receives, where it processes that data, and what legal mechanism covers data that leaves the European Economic Area (EEA).

There are three kinds of provider on this page, and the difference matters:

1. **Subprocessors.** Providers that process the conversations and lead data coaches hold in Luca. For that data the coach is the controller, we are the processor, and these companies are our subprocessors under our [Data Processing Agreement](/dpa).
2. **Providers for our own business.** Providers we use for coach accounts, billing, our website, analytics, and support. For this data SetLuca is the controller, and these companies are our processors.
3. **Platforms and tools you connect.** Services a coach chooses to connect, such as Instagram, Telegram, or a calendar. They act under their own terms and privacy policies. We send them data because the coach told us to, and they are not our subprocessors.

We don't sell personal data to any of them.

## 1. Subprocessors for conversation and lead data

| Provider | What it does for Luca | Data it receives | Where it processes data | Transfer mechanism outside the EEA |
| --- | --- | --- | --- | --- |
| **OpenRouter, Inc.** | Routes AI model requests that read messages, draft replies, summarize, classify, transcribe voice notes, and answer Ask Luca questions | The context needed for each request: lead messages, conversation history, writing-style samples, the coach's profile and offers, voice-note audio | United States | EU Standard Contractual Clauses |
| Upstream model providers reached through OpenRouter | Run the AI models | Same as OpenRouter, per request | Mainly the United States; depends on the model | Standard Contractual Clauses or EU-US Data Privacy Framework, depending on the provider. Ask support@setluca.com for the providers used for your workspace. |
| **Cloudflare, Inc.** | Hosting and edge network, Workers (our API and background code), R2 file storage (attachments, media), KV storage, Workers AI (text embeddings for search and memory), network security, Cloudflare Tunnel and Access in front of our self-hosted services | All data that passes through the service, including messages, attachments, and account data | Global edge network; file storage is placed automatically near where it is created | EU-US Data Privacy Framework certification, with Standard Contractual Clauses as a fallback |
| **PlanetScale, Inc.** | Primary database | Account data, workspace settings, leads, conversations, messages, bookings, writing-style samples, Instagram post insights | United States | EU-US Data Privacy Framework certification, and Standard Contractual Clauses in our agreement |
| **Hetzner Online GmbH** | Server hosting for services we run ourselves: our background-job engine (Inngest, self-hosted) and, if enabled, our AI tracing tool (Langfuse, self-hosted) | Background-job history, which includes inbound message text and writing-style samples | Germany (Falkenstein) | Not needed: within the EEA |
| **Functional Software, Inc. (Sentry)** | Error monitoring, logs, and, in the app, session replay with text and inputs masked | Technical diagnostics; we strip names, emails, tokens, and message bodies before sending, but fragments can appear in error text | United States (Google Cloud) | EU-US Data Privacy Framework certification, with Standard Contractual Clauses as a fallback |
| **Plus Five Five, Inc. (Resend)** | Sends email from Luca, such as sign-in links, alerts, and digests to coaches | Coach email address and the email content, which can include a lead's name or a message snippet | United States | Standard Contractual Clauses and EU-US Data Privacy Framework certification |
| **Infisical, Inc.** | Secrets management for our systems | Encrypted keys and credentials, including channel access tokens | United States | Standard Contractual Clauses |
| **PostHog, Inc.** | Product analytics inside the app | Pseudonymous events: workspace-level counts and the channel for funnel steps. No message text, names, handles, or emails | United States | EU-US Data Privacy Framework certification |

**Self-hosted services.** Inngest (background jobs) and Langfuse (AI tracing) are open-source tools we run on our own Hetzner servers in Germany, behind Cloudflare Tunnel and Cloudflare Access. They aren't separate vendors. Langfuse tracing is off by default and receives data only if we turn it on to investigate a problem.

**How we limit AI processing.** We send model providers only what a task needs. We configure requests to OpenRouter to go only to providers that don't store prompts or train on them. Voice-note transcription runs with zero data retention. OpenRouter doesn't keep our prompts or responses, and nobody uses your messages to train a model shared with other customers.

## 2. Providers for our own business

These providers handle data about coaches and website visitors, not lead conversations (except where noted).

| Provider | What it does for Luca | Data it receives | Where it processes data | Transfer mechanism outside the EEA |
| --- | --- | --- | --- | --- |
| **Stripe, LLC** | Subscription billing, payments, invoices, and tax records | Coach name, email, billing address, payment details (card data goes straight to Stripe), subscription and invoice history | United States | EU-US Data Privacy Framework certification, with Standard Contractual Clauses as a fallback |
| **PostHog, Inc.** | Website analytics on setluca.com, on by default until you turn it off | Pages viewed, device and browser data, IP address, and a pseudonymous ID that is linked to your account if you sign up | United States | EU-US Data Privacy Framework certification |
| **Cloudflare, Inc.** | Website hosting and network security | Page requests, IP address, browser data | Global | EU-US Data Privacy Framework certification, with Standard Contractual Clauses as a fallback |
| **Attio Limited** | Our customer-relationship records about coaches | Coach name, email, and account stage. No lead or conversation data | United Kingdom (Attio's platform runs on Google Cloud) | UK adequacy decision for transfers from the EEA, and Standard Contractual Clauses for onward transfers |
| **Plus Five Five, Inc. (Resend)** | Account and marketing email to coaches and website subscribers | Email address, name, email content, delivery and open events | United States | Standard Contractual Clauses and EU-US Data Privacy Framework certification |
| **Meta Platforms, Inc. / Meta Platforms Ireland Ltd.** | Advertising measurement: the Meta Pixel and website-form events on setluca.com (on by default until you turn it off), and the Conversions API from our app (**only if you opt in**) | Website: page events, Meta cookies and click IDs, and a hashed email, IP address and browser data if you fill in a website form. Account: hashed email, IP address, browser, Meta click and browser IDs, sign-up and subscription events, business category. Never conversation content | United States and Ireland | Standard Contractual Clauses (Meta's data transfer addendum) and EU-US Data Privacy Framework certification |
| **Slack Technologies, LLC** (Salesforce) | Internal alerts to our team | Coach name, email, and account stage. No lead or conversation data | United States | EU-US Data Privacy Framework certification and Standard Contractual Clauses |
| **Functional Software, Inc. (Sentry)** | Error monitoring on our website and app | Technical diagnostics; app session replay only where you've allowed it | United States (Google Cloud) | EU-US Data Privacy Framework certification, with Standard Contractual Clauses as a fallback |

## 3. Platforms and tools you connect

When a coach connects one of these, Luca exchanges data with it to do what the coach asked. Each one processes data under its own terms and privacy policy. They aren't our subprocessors.

| Platform or tool | Status | What Luca exchanges with it |
| --- | --- | --- |
| **Telegram** (Telegram Messenger Inc.) | Live | Messages and attachments sent to the coach's bot, and the replies Luca sends from it. Telegram requires every bot to have its own privacy policy; see our [DPA](/dpa). |
| **Instagram** (Meta) | Live | Direct messages, story replies and mentions, comments on the coach's own posts, comment-campaign replies, profile basics, and post insights. When the coach connects the account, Luca reads its recent conversations once and keeps only the coach's own replies as writing-style samples; leads' messages are discarded, and disconnecting deletes the samples. See "Meta platform data" and "Past-reply import" in our [Privacy Policy](/privacy). |
| **Messenger** (Meta) | Live | Page messages and replies, and Page details. When the coach connects the Page, Luca reads its recent conversations once and keeps only the Page's own replies as writing-style samples; leads' messages are discarded, and disconnecting deletes the samples. See our [Privacy Policy](/privacy). |
| **WhatsApp** (Meta) | Coming soon | Not connectable yet. It will use the coach's own WhatsApp Cloud API account. |
| **Google** and **Facebook** sign-in | Live | Name, email, and profile picture when you choose to sign in with them. |
| **Google Calendar**, **Calendly**, **Cal.com** | Live | Availability and the bookings Luca makes for leads (lead name, contact detail you collected, time). |
| **Signed webhooks** and the **REST API** | Live | The Luca events and data the coach subscribes or requests. |
| **MCP server**, used from **Claude**, **ChatGPT**, or another assistant | Live | The workspace data the coach's key allows. By default an assistant can read and draft. If the coach grants a wider scope, it can also send messages, book calls, or launch broadcasts. |
| **HubSpot**, **GoHighLevel**, **iClosed** | In progress, not available yet | Nothing today. We'll update this page before any of them can receive data. |

## Changes to this list

We update this page before a new subprocessor starts processing conversation or lead data. Coaches who have [accepted our DPA](/dpa) get at least 30 days' notice by email to the account owner before the change takes effect, and can object as the DPA describes.

Questions about how a provider handles personal data, objections to a change, and any other questions: [support@setluca.com](mailto:support@setluca.com).

SetLuca, LLC, 2810 North Church Street, Wilmington, DE 19802, United States.