Subprocessors
This register summarizes the processor categories PAULGA may use to operate the service. It is an implementation-backed working register, not yet a counsel-approved DPA exhibit.
Last updated: May 3, 2026
Current register
| Category | Providers | Data processed | Purpose | Evidence status |
|---|---|---|---|---|
| Hosting, deployment, and analytics | Vercel; Google Analytics when analytics consent is enabled | Page usage, device/browser metadata, consent-gated analytics events, deployment and request metadata | Web hosting, deployment, security, site measurement, and product improvement | Implemented in the web app; production contracts and retention still need final operator evidence. |
| Resend or equivalent transactional email provider | Email address, verification links, account notices, privacy request confirmations | Account verification, DSAR confirmation, and service notices | Implemented in the web app; provider contract and retention evidence still required. | |
| Payments and merchant-of-record routes | Toss Payments for Korean checkout; Lemon Squeezy and Stripe-related payment infrastructure for international checkout | Checkout identifiers, customer keys, order IDs, payment keys, masked card details, subscription status, refund and tax records | Subscription billing, top-ups, refunds, tax, fraud control, and accounting | Web and parent API implementation evidenced; production payment terms and finance retention schedule still required. |
| Backend infrastructure and storage | Production API, database, object/file storage, logs, and backups | Account, onboarding, service, community, subscription, credit, file, activity, and admin data | Service delivery, security, support, privacy deletion, and operations | Parent API schema and services evidenced; production region, backups, encryption, and log retention still required. |
| AI model providers | OpenAI, Anthropic, Google/Gemini, Replicate, embedding/rerank providers, or equivalent feature-specific providers | Prompts, images, generated outputs, uploaded document excerpts, render settings, and request payloads explicitly sent by the user. Native CAD/BIM project files are not collected or stored in standard workflows. | AI rendering, chat, document analysis, embeddings, reranking, and automation support | Parent API proxy evidenced; exact production models, no-training settings, provider retention, and transfer terms still required. |
Change notices
PAULGA may update this list as vendors, regions, models, or infrastructure change. Material processor changes will be reflected here and in the Privacy Policy when required.