Subprocessors

Last Updated: August 9, 2026

Version 2.2.0 · Effective Date: August 9, 2026

Platform

Hosting, database, auth

AI gateway

Model routing, ZDR upstream

Email

Outbound & inbound routing

Marketing-only

Public site assets

Operator & Data Controller

ShiftNode Digital s.r.o. (operator of the EM3A service at em3a.ai)
Registered office: Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic
Company ID (IČO): 249 06 123
Privacy contact: privacy@em3a.ai
Legal / procurement contact: legal@em3a.ai

English legal version controls. Localized routes may include summaries for visitor convenience, but the English text controls unless a separately signed agreement says otherwise.

What this list is

A "subprocessor" is any third party that processes customer personal data on behalf of ShiftNode Digital s.r.o.. This page lists the subprocessors used by the EM3A service today. It supplements — and does not replace — the detail set out in the Data Processing Agreement. Customers under a signed DPA are notified of material changes to this list per the notice clause in their DPA.

Core subprocessors (touch app data)

Subprocessor	Purpose	Data categories	Location	Transfer mechanism
Lovable Cloud (managed Supabase platform)	Application hosting, Postgres database, object storage, authentication, edge functions, backups.	All customer content stored in the workspace, account identifiers, session tokens.	European Union	EEA hosting; no international transfer required.
Lovable AI Gateway	Routing of large-language-model requests to upstream providers (currently Google Gemini and DeepSeek). Enforces zero-data-retention where the upstream supports it.	Content of prompts and returned completions for the duration of a request. Not retained for model training.	Upstream providers operate globally; gateway is EU-fronted.	EU Standard Contractual Clauses via the AI gateway operator.
ElevenLabs	Realtime synthetic voice, speech recognition, turn-taking, and post-call transcription for the optional Sales Simulator.	Live rehearsal audio, conversation transcript, an opaque session identifier, and the minimum selected project and offering context expressed during the rehearsal. Direct account identifiers are not sent.	United States / global infrastructure.	EU Standard Contractual Clauses and supplementary access controls. Provider-side audio storage is disabled and transcript retention is configured for one day.
Mailgun (via Lovable Emails infrastructure)	Outbound transactional and authentication email delivery.	Recipient email address, message content, delivery status, bounce and complaint metadata.	United States / European Union region (per Lovable Emails configuration).	EU Standard Contractual Clauses via the sender-domain operator.
Cloudflare	DNS management for em3a.ai subdomains and email routing for public aliases (support@, legal@, security@, etc.) to the operator's Google Workspace inbox.	Email envelope metadata (sender, recipient, subject); message content passes through in transit only and is not stored.	Global anycast network.	EU Standard Contractual Clauses via Cloudflare's data-transfer terms.
Google Workspace (ShiftNode Digital)	Receiving mailbox for the em3a.ai public aliases (support, legal, privacy, security, abuse) after Cloudflare Email Routing forwards them to the operator's team.	Any content customers voluntarily send to the public aliases.	Google Cloud EU region.	EU Standard Contractual Clauses via Google Workspace terms.

Marketing-site-only vendors (do not touch app data)

The following vendors only appear on public marketing pages such as the homepage. They never receive workspace data.

Vendor	Purpose	Data categories	Location	Transfer mechanism
Calendly	Embedded public demo scheduling for marketing visitors who choose to book a meeting.	Invitee name, email address, company, selected meeting time, and voluntary scheduling notes entered in Calendly.	United States / global infrastructure.	EU Standard Contractual Clauses via Calendly's data-processing terms.
Google Analytics	Restricted measurement of public marketing-page traffic and non-sensitive conversion events. Advertising storage, ad personalisation, and Google Signals are disabled.	Sanitized page URL and title, campaign parameters, coarse device/location data, and interaction-event names. Form contents and direct identifiers are not sent.	Global Google infrastructure.	EU Standard Contractual Clauses via Google's data-protection terms.
Vimeo	Hosting of marketing videos embedded on the public homepage.	IP address and coarse viewing analytics for visitors who play the video. No app data.	United States.	EU Standard Contractual Clauses via Vimeo's data-transfer terms.

Change notice

ShiftNode Digital s.r.o. will update this page whenever a subprocessor is added, removed, or materially changes its role. Customers under a signed DPA can request an email notification of changes at privacy@em3a.ai and may object to a new subprocessor in accordance with the DPA.