Data Processing Disclosure
Last updated: 2026-05-23
Sub-processors
- Lovable Cloud / Supabase — application backend, database.
- Cloudflare — CDN, WAF, DDoS protection, edge compute.
- Plausible Analytics — privacy-friendly, cookieless analytics (loaded only when consented).
International transfers
Transfers of EU personal data outside the EEA are made under the European Commission's Standard Contractual Clauses (SCCs).
Security measures
Encryption in transit (TLS 1.2+) and at rest (AES-256), row-level security on every user-data table, role-based access control, multi-factor authentication for staff, append-only audit logs, principle of least privilege, and regular security review.