Sub-processors
We do not sell personal data. We share only with processors acting under our instructions, under contracts requiring confidentiality and security measures (LGPD Art. 39 / GDPR Art. 28).
| Processor | Purpose | Location | Product | Minors |
|---|---|---|---|---|
| Supabase | database and authentication | Ireland (EU) | AstroLumi | ✅ |
| Google (Gemini API) | conversational engine | USA/EU | AstroLumi / Soulloop | ✅ no retention for training |
| Meta (WhatsApp) | message delivery | global | AstroLumi | ⚠️ opt-in only |
| Stripe | payments | USA/EU | both | ⛔ |
| Resend | transactional and editorial email | USA/EU | AstroLumi | ✅ transactional / ⚠️ editorial opt-in only |
| Amplitude | analytics and session recording | USA | AstroLumi | ⛔ |
| Google Analytics / Google Ads | analytics and campaigns | USA | AstroLumi | ⛔ |
| MoEngage | communication and campaigns | USA/India | Soulloop | ⛔ |
| UXCam | session recording | USA | Soulloop | ⛔ |
| Firebase | authentication, messaging, diagnostics | USA/EU | Soulloop | ✅ minimum, no advertising |
| RevenueCat | subscriptions | USA | Soulloop | ⛔ |
This list is kept in a readable, versioned format. Changes are announced 30 days in advance, and the data subject may object to a new processor that handles sensitive data, where applicable.
The list states, for each processor, whether or not it receives data of users under 18 — the “Minors” column above.