Subprocessors
Last updated: 2026-04-19.
DRAFT , pending counsel review. Subprocessor list pending DPA countersigning. This page will be updated as agreements are finalized.
Lucidity, Inc. uses the third-party service providers listed below (“subprocessors”) to operate the Services. Each subprocessor is bound by a Data Processing Agreement (DPA) requiring them to process personal data only on Lucidity's instructions, maintain appropriate security, and honor deletion requests.
This page is updated at least 30 days before we add or materially change a subprocessor, unless the change is required for urgent security reasons. Enterprise customers may subscribe to change notifications at privacy@lucidity.today.
| Vendor | Purpose | Data Processed | Region | DPA Signed | Data-Handling Notes |
|---|---|---|---|---|---|
| AWS (Bedrock) | AI coach processing (hosts Anthropic Claude models) | Journal text at time of coach call | US (us-east-1) | AWS DPA accepted | Invocations not logged by default; Anthropic does not receive prompts on this path; not used for training |
| Stripe | Payments | Card, email, billing | US | TBD | n/a |
| Fly.io | API hosting | All app data at rest (encrypted) | US / EU | TBD | n/a |
| Vercel | Website hosting | Static pages, form payloads | US | TBD | n/a |
| Resend | Transactional email | Email addresses, message contents | US | TBD | n/a |
| Sentry | Crash reporting | Error stack traces, scrubbed PII | US | TBD | n/a |
| PostHog (self-hosted) | Analytics | Event streams, user properties | US | n/a | n/a |
| VIA Institute | Character strengths licensing | Participant responses | US | TBD | n/a |
| Typeform | Assessments + application forms | Survey responses | EU | TBD | n/a |
Notes
AI processing via AWS Bedrock.Our AI Coach and related features route to Anthropic’s Claude models hosted inside AWS Bedrock. AWS is the data processor under the AWS DPA, AWS does not log Bedrock invocations by default, and Anthropic does not receive the prompts on this path. Anthropic is a sub-subprocessor to AWS in this architecture and is not listed in the table above as a direct subprocessor. [Status as of 2026-04-19: AWS account provisioned, DPA accepted, Bedrock model access configured for Claude Sonnet 4.6 and Claude Haiku 4.5.]
Sub-subprocessors.Some of the vendors above use their own sub-subprocessors (for example, cloud infrastructure providers under Fly.io or Vercel). These chains are disclosed in each vendor's own subprocessor list, which is linked from their DPA.
International transfers.Where data is transferred out of the EU / UK / EEA we rely on the European Commission's Standard Contractual Clauses or an equivalent lawful mechanism. Copies are available on request at dpo@lucidity.today.
How to object
Enterprise customers may object to the addition of a new subprocessor in writing to privacy@lucidity.today within 30 days of our notice. If we cannot accommodate the objection by using an alternative, the customer may terminate the affected Services with a pro-rata refund.
Contact
privacy@lucidity.today · dpo@lucidity.today · see also /privacy.