Notify Sub-processors
Last Updated: 10/19/2026
This page identifies the providers in Notify's processing arrangements, including direct managed providers and the upstream AI model provider. It is incorporated into our Privacy Policy and read together with the Data Processing Addendum. An upstream listing does not represent a direct contract or API account between Notify and that provider. Some listed services, including payment processing and Client-connected accounts, may also process information as independent controllers under their own applicable terms. Their listing does not make every activity a Sub-processor activity; the Data Processing Addendum governs processing of Client Personal Information on Client's behalf.
The Data Processing Addendum requires applicable confidentiality, limited-purpose, security, and no-training obligations through the processing chain. The descriptions below identify known technical roles; they do not certify unverified gateway-specific contractual coverage or locations.
| Sub-processor | Function | Categories of Information | Location scope |
|---|---|---|---|
| Supabase | Database hosting, authentication, file storage | Account data, business configuration, leads, conversation transcripts, bookings, uploaded images | US application database hosting; full support and other handling scope requires provider confirmation |
| Lovable (Lovable Labs Incorporated) | Managed application platform, hosting and backend; transactional/digest email delivery; managed AI Gateway intermediary | Application request data; AI prompts, chat messages, business context, job photos and outputs; email recipients and content; IP address and request metadata | US customer-content inference is requested and checked; gateway storage, logs, support and other handling locations are not independently confirmed |
| Anthropic, PBC | Upstream Claude model provider accessed through Lovable-managed AI; chat responses, follow-up drafts and job-photo assessments | Chat message content, business configuration context (services, prices, hours, availability), uploaded photos, lead details used in follow-up drafts | US inference requested and checked; upstream storage, safety review, support and complete handling scope require confirmation through the managed provider |
| Google LLC | Google Calendar integration; optional Google Sign-In | Calendar availability, created calendar events, authentication identifiers | US-based provider; processing and support locations depend on the applicable service arrangements, not confirmed exclusively US |
| Stripe, Inc. | Payment processing and subscription billing | Billing name, email address, payment method details, transaction records | US-based provider; processing and support locations depend on the applicable service arrangements, not confirmed exclusively US |
| Apple Inc. / Google LLC / browser push services | Push notification delivery | Notification tokens, notification content | US-based provider; processing and support locations depend on the applicable service arrangements, not confirmed exclusively US |
A Note on AI Model Providers
Notify's AI features use Anthropic Claude through Lovable's managed AI Gateway. Lovable is the gateway intermediary and Anthropic is the upstream model provider; Notify does not maintain a direct Anthropic API account for this route. Notify does not use Client Personal Information to train models and requires no-training protections through the managed processing chain under the Data Processing Addendum. Anthropic's general commercial API retention policy is not proof of the gateway's applicable retention period or upstream account configuration. We do not claim zero retention, a verified end-to-end 30-day maximum, or exclusively US gateway storage, logs, support and safety review. US customer-content model inference is requested and the reported location checked; that control is not verification of every processing location. Available contractual and provider details may be requested at the contact below; the Data Processing Addendum's obligations remain in force.
Changes to This List
We may add, replace, or remove sub-processors as our infrastructure changes. When we do, we update this page and the "Last Updated" date above. Notice, objection, termination, and refund rights are governed by Sections 10.4 and 10.4.1 of the Data Processing Addendum; posting an update does not by itself establish delivered notice.
We will send affected Business Clients the notices required by Section 10.4 of the Data Processing Addendum using their account notice details. Clients may contact privacy@informic.app to update those details or request an additional notification recipient.