LunieAI

Subprocessors

These are the third parties that process data on our behalf. Each entry says what it actually receives. See the Privacy Policy for how the two groups of people referred to below differ.

This document is not finalIt accurately describes how the software handles data, but the operating company’s registered details are still to be confirmed and it has not yet been reviewed by a legal adviser. It should not be relied on as published policy until both are done.

Customers under our Data Processing Agreement are given reasonable notice before this list changes.

Google (Firebase Authentication)

United States

Account authentication - email address, password credential, display name, Google sign-in identity, sign-in timestamps.

Account holders

Transfer outside the EEA. Google LLC relies on the EU-US Data Privacy Framework and Standard Contractual Clauses.

Google (Gemini API)

United States

Generating chatbot replies. Receives the visitor's question, the retrieved passages from the customer's own content, and recent conversation context.

Chat visitorsAccount holders

Transfer outside the EEA. Anything a visitor types into a chat is sent to this provider to produce a reply.

Upstash (Redis)

Depends on the configured Upstash region.

Rate limiting. Stores a per-user, per-chatbot counter key. No message content.

Account holders

Stripe

United States

Billing. A Stripe customer reference is stored against the profile.

Account holders

Status: Configured but not currently active - profiles.stripe_customer_id exists, no payment flow is live.

Transfer outside the EEA.

Hosting provider (self-hosted infrastructure)

Our own server infrastructure.

Runs the application, the PostgreSQL database (Supabase), the Qdrant vector database, the crawler, the embedding service and the OCR service. All customer and visitor data at rest lives here.

Account holdersChat visitors

Not used

To avoid implying data flows that don’t exist: LunieAI does not send data to OpenAI or Pinecone. Configuration for both exists in the codebase for historical reasons, but no code path calls either. Vector search runs on a self-hosted Qdrant instance and embeddings are generated by a self-hosted model, both on our own infrastructure.