Sub-processor List
The companies that process data on our behalf, and where.
Version 1.0 · In effect from 15 October 2026 · Current page
1. What this list is
1.1 This is the published list of third parties that process personal data on behalf of SkillSwap Ltd, trading as Lemma, in operating Lemma. It is Annex III to the Data Processing Agreement, and is referred to in the Privacy Policy.
1.2 A sub-processor is engaged only after an assessment of its security and data protection posture, and only under a written contract containing obligations at least as protective as those we owe (GDPR Art. 28(4)).
2. The list
Two transfer mechanisms are used in the final column. EU/EEA hosting means the data is stored and processed in the EEA. SCCs means the 2021 Standard Contractual Clauses (Implementing Decision (EU) 2021/914) in the vendor's data processing terms, which cover any transfer outside the EEA, including remote access by a US-based provider. See section 3.
| Sub-processor | Service provided | Categories of data processed | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Neon Inc. (a Databricks company) | Managed PostgreSQL — the primary database | Substantially all Platform personal data — profiles, Evidence Events, SCI values, Session records, assessment responses and results, Credit ledger | EU — AWS eu-central-1 (Frankfurt) | EU/EEA hosting; SCCs for provider access |
| Vercel Inc. | Hosting of the website and app, edge delivery, serverless functions; AI Gateway for the website assistant | Technical and connection data (IP address, user agent, request metadata); personal data carried in requests and responses; website assistant messages in transit | Functions in the EU (fra1, Frankfurt); edge delivery global | SCCs (Vercel also states it is certified under the EU–US Data Privacy Framework) |
| Railway Corp. | Back-end API and worker hosting | Account, Session and assessment data in process; technical logs | EU (Amsterdam, Netherlands) | EU/EEA hosting; SCCs for provider access |
| Cloudflare, Inc. | DNS and network protection for our domains (API traffic passes through Cloudflare); R2 object storage for uploaded files and attachments | Technical and connection data; uploaded files | Cloudflare's global network; the storage bucket is not currently restricted to the EU | SCCs |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payments and subscription billing | Name, email, billing address, country, payment token, transaction records | Ireland and United States | SCCs. Stripe is also an independent controller for its own regulatory and anti-fraud purposes |
| LiveKit, Inc. | Real-time audio and video for Sessions | Audio and video streams in transit (not stored), connection metadata, participant identifiers | LiveKit Cloud's global network: media is relayed through servers close to the participants, which may be outside the EU | SCCs |
| Resend, Inc. | Transactional email — account, booking, assessment invitations, notifications | Name, email address, message content and delivery metadata | Sent from the EU (Ireland) region; US company | SCCs for provider access |
| Google LLC / Google Ireland Ltd. (Firebase Authentication, Cloud Firestore) | Sign-in and identity; real-time delivery of chat messages | Email address, authentication identifiers, sign-in metadata, device and IP data; chat messages | Authentication: United States. Chat delivery (Cloud Firestore): EU multi-region (eur3) | SCCs |
| OpenAI, L.L.C. | AI Tutor, assessment question generation and scoring, website assistant | Tutor conversations and memory; assessment answers; website assistant messages; no direct identifiers sent | United States | SCCs. API data is not used to train models |
| Anthropic PBC | Monthly report cards; fallback for the AI Tutor, question generation and scoring | Report card inputs (activity summaries); Tutor and assessment content when used as fallback; no direct identifiers sent | United States | SCCs. API data is not used to train models |
| Functional Software, Inc. (Sentry) | Application error monitoring | Stack traces, request metadata, pseudonymous user identifier; cookies removed before sending | EU — Germany | EU/EEA hosting; SCCs for provider access |
| PostHog, Inc. | Analytics on the website and in the app, loaded only after opt-in consent; session replay on the website only, with all typed input masked | Pseudonymous usage events, page interactions, device and browser data | EU cloud | EU/EEA hosting; SCCs for provider access |
| Google Ireland Ltd. / Google LLC (Google Tag Manager, Google Analytics 4, Google Ads conversion measurement) | Website analytics with Analytics consent; ad conversion measurement with Marketing consent. Not used in the app | Pseudonymous identifiers, pages viewed, events and conversions, ad click identifiers, device and approximate location data | EU and United States | SCCs |
| Sanity AS | Content management for the website (blog posts, images) | Staff names and email addresses of editors; no User data | EU — Belgium (Google Cloud), with processing in the United States by Sanity's own sub-processors | EU/EEA hosting; SCCs for onward transfers |
Services you connect. GitHub, Figma, Vercel (as a source of your work), Google Calendar and Telegram receive or provide data only when you connect them. They act as independent controllers under their own terms and are not our sub-processors; see the Privacy Policy, clause 6.2.2A.
3. On transfer mechanisms — an honest statement
3.1 For every transfer outside the EEA we rely on the 2021 Standard Contractual Clauses in the vendor's data processing terms, supported by a transfer impact assessment. Some vendors are also certified under the EU–US Data Privacy Framework; we do not rely on that certification, so this list does not track it, except where a vendor's own statement is noted.
3.2 We take this approach deliberately. The DPF was upheld in T-553/23 Latombe (3 September 2025), but that judgment is under appeal to the Court of Justice (lodged 31 October 2025, pending), and certifications attach to specific entities and can lapse.
4. Hosting regions
4.1 Our primary database (Neon) and our application functions (Vercel fra1) are in Frankfurt, our API and background workers run in Amsterdam (Railway), chat delivery is in the EU (Firestore eur3), and error monitoring and analytics are hosted in the EU. Where a service still processes data outside the EU, the table says so and the transfer mechanism applies.
4.2 We do not record Sessions. Session audio and video pass through LiveKit in real time and are not stored.
5. Changes to this list
5.1 We give at least 30 days' prior written notice before engaging a new sub-processor or replacing an existing one — by email to the data protection contact each API Client has notified to us, and by updating this page with a new version number and date. Users may subscribe to change notices by emailing privacy@getlemma.io.
5.2 Where a change must be made faster — to replace a vendor that has suffered a security incident or ceased trading — we engage the replacement and give notice as soon as we reasonably can, explaining why the notice period could not be met.
6. How to object
6.1 An API Client acting as controller under the Data Processing Agreement may object to a new sub-processor on reasonable data protection grounds within 15 days of our notice, by emailing privacy@getlemma.io with the grounds.
6.2 We will discuss it in good faith and look for an alternative. Failing that, the Client may terminate the affected services on written notice without penalty and receive a pro-rata refund of prepaid fees for the unused period.
6.3 A User who is not an API Client cannot object to an individual sub-processor — these providers are integral to running the Platform — but can withdraw consent for optional processing, including analytics, and exercise the rights in the Privacy Policy.
6.4 Questions: privacy@getlemma.io, for the attention of our privacy lead. Security: security@getlemma.io.