Sub-processors

Last updated: September 2, 2026

This page lists the companies that process personal data on Lulla's behalf (“sub-processors”), what data they receive and where they process it. It is the part of the Privacy Policy that changes most often, which is why it lives separately. Any addition or replacement of a significant sub-processor is announced here and in the app at least 30 days before it takes effect.

Active sub-processors

Sub-processor	Role	Data processed	Location and transfer
Supabase, Inc. (Amazon Web Services infrastructure)	The app's backend: authentication, database, photo storage, sync, server functions. It also sends account emails (confirmation, password reset).	The account (email, authentication session), the parent profile, the child profile (name, date of birth, sex, photo), everything recorded in the app (sleep, feeds, nappies, temperatures, growth, vaccines and the vaccination-record photos, medication, moments with photos), family sharing, invite codes, idea box messages with any screenshots, usage events (which screens and features are used, without content).	European Union: the project is hosted in the AWS Ireland region (eu-west-1). There is no transfer outside the European Economic Area for this data.
Google LLC	Google Play: the Premium subscription (payment, purchase verification), the optional “Continue with Google” sign-in, in-app reviews and the install source.	For payment: the purchase identifier, the product, the price (Google processes the payment as the store, not us). For Google sign-in, only if you choose it: the email address and an identity token. The install source (Play referrer). No child data.	USA. Transfer on the basis of the Standard Contractual Clauses and of the EU-US Data Privacy Framework, under Google's terms.
AppsFlyer Ltd.	Measuring promotional campaigns: which ad an install came from and whether it led to a subscription. Active only if you accepted the marketing option at first launch (it can be withdrawn from Settings).	The device's advertising identifier, an AppsFlyer device identifier, the install source, technical data about the device and the app, and events: setup completed, paywall shown, trial started, purchase (with the amount). No names, no child data, no content.	Israel and the USA, with Standard Contractual Clauses under the AppsFlyer data processing agreement.
RevenueCat, Inc.	Subscription analytics (revenue, renewals, cancellations). It sells nothing and does not decide access to features; it receives only a copy of the purchase data.	A pseudonymous user identifier, the subscription data from Google Play (product, price, status), and, if you accepted marketing, the AppsFlyer identifier and the campaign source. No email, no name, no child data.	USA, with Standard Contractual Clauses under the RevenueCat data processing agreement.
Vercel Inc.	Hosting the getlulla.app website: page delivery, page rendering and the website's API routes (the newsletter form, website usage events).	IP address, user agent, accessed URL, referrer, timestamp, country derived from the IP. No child data.	The content is delivered from the European edge network (Frankfurt), but the server functions run in the USA (Washington D.C.), with Standard Contractual Clauses under the Vercel data processing agreement.
Resend, Inc.	Sending the emails from the website: the newsletter welcome message, the sleep schedule in PDF format and the internal notification of a new subscription.	The email address, the language, the content of the email sent and the delivery status. No name, no child data, no payment data.	USA, with Standard Contractual Clauses under the Resend data processing agreement.

Supabase, Inc. (Amazon Web Services infrastructure)

Role: The app's backend: authentication, database, photo storage, sync, server functions. It also sends account emails (confirmation, password reset).
Data processed: The account (email, authentication session), the parent profile, the child profile (name, date of birth, sex, photo), everything recorded in the app (sleep, feeds, nappies, temperatures, growth, vaccines and the vaccination-record photos, medication, moments with photos), family sharing, invite codes, idea box messages with any screenshots, usage events (which screens and features are used, without content).
Location and transfer: European Union: the project is hosted in the AWS Ireland region (eu-west-1). There is no transfer outside the European Economic Area for this data.

Google LLC

Role: Google Play: the Premium subscription (payment, purchase verification), the optional “Continue with Google” sign-in, in-app reviews and the install source.
Data processed: For payment: the purchase identifier, the product, the price (Google processes the payment as the store, not us). For Google sign-in, only if you choose it: the email address and an identity token. The install source (Play referrer). No child data.
Location and transfer: USA. Transfer on the basis of the Standard Contractual Clauses and of the EU-US Data Privacy Framework, under Google's terms.

AppsFlyer Ltd.

Role: Measuring promotional campaigns: which ad an install came from and whether it led to a subscription. Active only if you accepted the marketing option at first launch (it can be withdrawn from Settings).
Data processed: The device's advertising identifier, an AppsFlyer device identifier, the install source, technical data about the device and the app, and events: setup completed, paywall shown, trial started, purchase (with the amount). No names, no child data, no content.
Location and transfer: Israel and the USA, with Standard Contractual Clauses under the AppsFlyer data processing agreement.

RevenueCat, Inc.

Role: Subscription analytics (revenue, renewals, cancellations). It sells nothing and does not decide access to features; it receives only a copy of the purchase data.
Data processed: A pseudonymous user identifier, the subscription data from Google Play (product, price, status), and, if you accepted marketing, the AppsFlyer identifier and the campaign source. No email, no name, no child data.
Location and transfer: USA, with Standard Contractual Clauses under the RevenueCat data processing agreement.

Vercel Inc.

Role: Hosting the getlulla.app website: page delivery, page rendering and the website's API routes (the newsletter form, website usage events).
Data processed: IP address, user agent, accessed URL, referrer, timestamp, country derived from the IP. No child data.
Location and transfer: The content is delivered from the European edge network (Frankfurt), but the server functions run in the USA (Washington D.C.), with Standard Contractual Clauses under the Vercel data processing agreement.

Resend, Inc.

Role: Sending the emails from the website: the newsletter welcome message, the sleep schedule in PDF format and the internal notification of a new subscription.
Data processed: The email address, the language, the content of the email sent and the delivery status. No name, no child data, no payment data.
Location and transfer: USA, with Standard Contractual Clauses under the Resend data processing agreement.

Announced sub-processors, not yet active

Sub-processor	Role	Data processed	Location and transfer	Effective date
Anthropic, PBC	The “Lulla AI” conversational assistant (Premium subscription, optional feature, enabled only after accepting its terms).	The messages you type or dictate in the conversation, the images you attach, summaries of the child's data needed for the question (sleep, feeds, nappies, temperatures, growth, vaccines, medication), the child's name, age and sex, the app language. Not used to train models. Conversations stay on the phone only. Voice dictation uses the phone's own speech recognition service, not our servers.	USA, with Standard Contractual Clauses included in the data processing agreement with Anthropic.	October 2, 2026 at the earliest
PostHog, Inc.	Statistics about app usage (which features are used, retention), without content and without identifying the person. Not active at present.	Usage events tied to a pseudonymous install identifier, the country and the app version. No name, email, content or child data. Only with the marketing option accepted.	European Union (PostHog EU hosting, Germany).	Not planned; you will be notified 30 days in advance

Anthropic, PBC

Role: The “Lulla AI” conversational assistant (Premium subscription, optional feature, enabled only after accepting its terms).
Data processed: The messages you type or dictate in the conversation, the images you attach, summaries of the child's data needed for the question (sleep, feeds, nappies, temperatures, growth, vaccines, medication), the child's name, age and sex, the app language. Not used to train models. Conversations stay on the phone only. Voice dictation uses the phone's own speech recognition service, not our servers.
Location and transfer: USA, with Standard Contractual Clauses included in the data processing agreement with Anthropic.
Effective date: October 2, 2026 at the earliest

PostHog, Inc.

Role: Statistics about app usage (which features are used, retention), without content and without identifying the person. Not active at present.
Data processed: Usage events tied to a pseudonymous install identifier, the country and the app version. No name, email, content or child data. Only with the marketing option accepted.
Location and transfer: European Union (PostHog EU hosting, Germany).
Effective date: Not planned; you will be notified 30 days in advance

What we do not use

We do not use in-app ad networks, push notification services (all reminders are generated on the phone), error reporting services, and we do not sell data to anyone.

History

September 2, 2026: first publication of the page; announcement of Anthropic (Lulla AI) and PostHog. Addition of Vercel (website hosting) and Resend (emails from the website); correction of the Supabase region to Ireland (eu-west-1).