Subprocessor list

• Hosting provider (Hetzner Online GmbH): application, database and Redis hosting, and storage for data exports and encrypted backups. Redis holds sign-in blocklist and rate-limit state. Servers and storage are in Germany.
• Cloudflare: carries all traffic to this website and to the app's servers (luminaraadventures.com and its www, app and api addresses). It ends the encrypted (TLS) connection and passes each request on to our servers, so it processes the full content of every request and response, including the account and play data the app sends, and the IP address and browser or app details of each visitor. Each request is handled at the Cloudflare data centre nearest the visitor, which can be outside the European Union. It keeps copies of the website's public files, such as images and style sheets, in its cache; app responses pass through without being cached. When a browser cannot reach this website or the app's servers, it sends Cloudflare a network error report (the address it tried, the kind of error, how long the attempt took and the browser's details), which Cloudflare uses to monitor its network. We use Cloudflare this way while our servers' own certificates are being set up; when traffic goes straight to our servers, this entry will change. Cloudflare also provides domain name service, forwards mail sent to our role addresses, and keeps an encrypted copy of database backups in its EU storage.
• Resend: sends transactional mail to caregivers, such as the verification link. Addresses are caregiver personal information, so a data processing agreement is required. Resend stores message content, delivery logs and account records in the United States.
• Sentry: crash reporting. Identifiers such as the child profile id are removed before a report is sent.

• RevenueCat: purchase receipts and entitlements only. No purchases are available in the beta.
• Stripe: purchase receipts and entitlements, and caregiver billing identifiers. No purchases are available in the beta.

Clinician and organization services, which could involve health information, are not part of the beta. If they launch, this list and the agreements behind it will be updated first.

Our plan is to give 30 days' notice before a new subprocessor goes live and to review this list every quarter. This page does not claim that either step has been completed.