Version: 2026-10-21 · Last updated: 21 October 2026
This page is the authoritative list of LightPane's subprocessors. It is incorporated into our Terms and Conditions by reference, and our Privacy Policy explains how we use the data each one handles.
1. What a subprocessor is, and what it is not
A subprocessor is a third party that processes personal data on our behalf, under our instructions, so that we can provide the Service. Those are listed in Section 3.
Amazon Web Services appears in both roles and the distinction matters: AWS is our host, and so a subprocessor of ours (Section 3); AWS is also a provider many customers connect, and in that role it is the customer's own system, not ours.
2. How we notify changes
We will publish any change to this list on this page at least 30 days before a new subprocessor begins processing personal data.
If you object to a new subprocessor on reasonable data-protection grounds, tell us within those 30 days at support@cloudsandlight.com. If we cannot offer a reasonable alternative, you may terminate the affected subscription without penalty and we will refund any fees covering the period after termination.
Where we must replace a subprocessor urgently to maintain the security or continuity of the Service — for example if a provider suffers a security incident, or ceases to operate — we may do so with shorter notice, and will tell you as soon as we reasonably can. Section 4 explains how we keep that carve-out narrow in practice.
3. Current subprocessors
Each of the following processes personal data on our behalf, only for the purpose described.
- Purpose: hosting and operating the platform — compute, storage, databases, content delivery
- Data: all personal data held by the Service, as infrastructure rather than as a recipient. AWS does not access or process it except as necessary to provide hosting.
- Location: Europe (Ireland), with disaster-recovery replication to Europe (Frankfurt)
- Transfers: data remains in the EEA; see Section 7 of the Privacy Policy
- Purpose: delivering transactional email — sign-in links, account notices, support replies
- Data: your name, your email address, and the content of the message. Resend also reports delivery outcomes back to us, such as a bounce or a spam complaint.
- Location: United States
- Transfers: UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses
- Purpose: understanding how the product is used, so we can improve it
- Data: for signed-in users, product events identified by account ID. For anonymous visitors, page views only — the page opened, the referring site, and any campaign parameters — each sent with a random value generated fresh, used once and never stored, so views cannot be linked to each other or to a person. In both cases PostHog also receives the technical data inherent in any web request, such as your IP address. Our analytics is cookieless: nothing is stored on your device and there is no persistent identifier for anonymous visitors.
- Location: PostHog Cloud EU
- Transfers: data remains in the EEA
- Purpose: taking payments and managing subscriptions
- Data: your billing details, processed by Stripe directly. We never see or store your full card details — we hold only the identifiers Stripe gives us, your plan, and your billing status.
- Location: United States and Ireland
- Transfers: UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses. Stripe also acts as a controller in its own right for payment data, under its own privacy policy.
- Purpose: letting you sign in with an existing account instead of waiting for an email link. Entirely optional — the email link always remains available, and nothing is shared with either company unless you choose their button.
- Data: we ask only for your name, your email address, and the identifier the provider uses for you. We request no other permission.
- Location: United States
- Transfers: each acts as a controller in its own right for its own purposes, under its own privacy policy, rather than as our processor. They are listed here for completeness because using one necessarily tells that provider you signed in to LightPane.
4. Standby providers
Naming them here is the notice. If one is ever brought into use, it will already have been published on this page well beyond 30 days, you will already have had the opportunity to object under Section 2, and we will update Section 3 and the version date at the point it actually begins processing.
Identified as a replacement for Resend (Section 3.2). It would process the same data for the same purpose, hosted in the same AWS region as the rest of the platform — Europe (Ireland), so within the EEA.
Identified as an alternative to Amazon Web Services (Section 3.1) for hosting and operating the platform. Any move would keep production in an EEA region.
We do not maintain a standby for every subprocessor. Where a provider could be removed without the Service stopping — product analytics, for example — the risk of losing it is lower and the ordinary 30 days' notice is sufficient.
5. International transfers
We are a UK data controller and your data is stored in the European Economic Area. Where a subprocessor above is based outside the UK and EEA, or supports its service from outside it, the transfer is protected by an appropriate safeguard — an adequacy decision, or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses — as set out in our agreement with that processor, and as recorded against each entry in Section 3.
6. Questions
If you have a question about this list, want to object to a change under Section 2, or require a data processing agreement, contact support@cloudsandlight.com.