We keep on your device only what is strictly necessary to run the app and — only if you allow it — we measure how it performs and follow your visits to our website. Refusing is as easy as accepting. Read our privacy policy.
Policy version: cookie-policy-2026-10-14
Lume CRM engages the subprocessors below to deliver the service. Each is bound by a Data Processing Agreement, or DPA, and subject to equivalent data-protection obligations, except the services marked “None” in the table. We notify customers at least 30 days before adding a new subprocessor that processes personal data.
| Name | Role | Data processed | Hosting | DPA |
|---|---|---|---|---|
| Supabase Inc. | Managed PostgreSQL, authentication, file storage, realtime | All tenant data: identity, contact details, business data, audit logs | Canada, AWS ca-central-1, Montréal | Link |
| Railway Corp. | Application hosting: Node.js API and background jobs | Ephemeral request and response data, application logs, environment secrets | United States, Virginia, us-east4 region | Link |
| Cloudflare, Inc. | Delivery network in front of all lumecrm.net traffic, attack protection and rate limiting, Turnstile CAPTCHA on sign-in, sign-up and public forms | All requests and responses in transit, decrypted on the way, including IP address and browser; browser signals for the CAPTCHA; no durable storage of tenant data | Global, data center network, US company | Link |
| Stripe Inc. | Card and bank payment processing, Stripe Connect | Tokenized card data, email, amounts, business identity for Connect | Global, primarily the United States | Link |
| PayPal Holdings | Alternative payment processing | Buyer email, amounts, order details | Global, United States and Luxembourg | Link |
| Twilio Inc. | Inbound and outbound text messages, phone number provisioning | Phone numbers, text message content | United States | Link |
| Amazon Web Services, Amazon SES | Transactional email delivery and bounce notifications | Recipient email address, email content, attachments | Canada, AWS ca-central-1 | Link |
| Anthropic, PBC | Claude models: Lumi, the in-app AI assistant, AI support, the public website assistant and the import assistant | Request and conversation text, account data Lumi reads to answer, screenshots attached to support requests | United States | Link |
| Google LLC, Maps Platform | Address geocoding and suggestions, maps, building measurements | Postal addresses and job site coordinates | Global | Link |
| Google LLC, Gemini API | Transcription of voice dictation and of voice notes received by text message, Lumi similarity search, import suggestions | Audio recordings, text of requests to Lumi, masked samples of imported files | Global | Link |
| Google LLC, Google Fonts | Typeface that Google Maps loads by itself in the app | User's IP address and browser, no account data | Global | None |
| Intuit Inc., QuickBooks Online | Accounting sync, only for offices that connect QuickBooks | Clients, invoices, payments and payment method used, sent to the office’s QuickBooks | United States | Link |
| Resend, Inc. | Transactional email delivery, when this provider is enabled | Recipient email address, email content, attachments | United States | Link |
| 650 Industries, Inc., Expo | Push notifications to the mobile app, relayed to Apple and Google | Device push token, notification title and text | United States | None |
| Open-Meteo GmbH | Home screen weather | Coordinates of the office’s operating city, no personal data | Europe and North America | None |
| Mapbox, Inc. | Base maps, fallback geocoding, directions | Postal addresses and job site coordinates | United States | Link |
| OpenStreetMap Foundation, Nominatim | Last-resort geocoding when Google and Mapbox cannot find an address, city boundaries for the revenue-by-city map, fallback base map | Postal addresses, name and approximate coordinates of the cities where the office works, browser IP address for boundaries and base map | Europe | None |
| FOSSGIS e.V., serveur OSRM | Travel-time calculation for route optimization | GPS coordinates of job sites | Germany | None |
| DiceBear | Default illustrated avatars for team members and records | The person's technical identifier, or their name when the identifier is missing, and the browser's IP address | Europe | None |
| Functional Software, Inc., Sentry | Crash reporting and, with your consent, performance measurement | Technical account identifier, company name, error traces | United States | Link |
| Slack Technologies, LLC | Routing support requests to our team | Company name and support request content | United States | Link |
| HighLevel, Inc., GoHighLevel | Our team’s follow-up of demo requests, account usage and, with your consent, public website visits | Name, company, email, phone and message of demo requests, originating campaign; aggregated account usage indicators and Lume subscription state, never your clients’ data; with your consent, pages visited and fields typed on the public website | United States | None |
| Upstash Inc. | Redis rate-limit cache, when enabled | Hashes of auth-token suffixes and IP addresses, no personal data | Global | Link |
| Microsoft Corporation, OneDrive | Off-site copy of the encrypted database backups | Encrypted backups of all tenant data, unreadable by Microsoft: the decryption key is never stored on OneDrive | United States or Canada, depending on the account | None |
Zapier, by Zapier Inc. in the United States, and Make, by Celonis Make Technologies in the Czech Republic, hosted in the United States for the us2 zone, are not Lume CRM subprocessors: Lume sends them nothing on its own. Your business decides to connect them, through its owner or an admin, in its own Zapier or Make account. They then become your providers, under your own terms with them.
Once connected, they receive what your scenarios ask for: your clients’ and leads’ contact details, meaning name, email, phone and address, then the status, amounts and dates of your quotes, invoices and jobs. Never your internal notes, custom fields or payment data. You can remove access at any time in Settings › API & MCP: deliveries stop right away.
Primary data storage is in Canada, with Supabase, in the AWS ca-central-1 region in Montréal. The application server runs in the United States, with Railway, and several subprocessors in the table process data outside Canada. For Québec data subjects, a Privacy Impact Assessment, required by Law 25 section 17, covers these transfers. For EU data subjects, transfers are covered by Standard Contractual Clauses.
Changes to this list are announced by email to the billing contact of each organization at least 30 days before taking effect. Customers may object to a new subprocessor in writing; we will discuss in good faith and, if no agreement is reached, the customer may terminate the affected portions of the service.
For questions about subprocessors, contact [email protected].