Sub-Processor Register
Version: 1.1 · Owner: Pocket PMO Ltd · Approval status: Approved · Review date: on material change
The following are the sub-processors used to deliver the Pocket PMO Service at the effective date of this register. Material changes are announced on the Trust Centre with at least 30 days' notice.
Direct sub-processors (engaged by Pocket PMO Ltd)
Core infrastructure
| Sub-processor | Purpose | Data | Region | Transfer mechanism |
|---|
| Lovable Cloud (managed Postgres, storage, edge functions, built on Supabase) | Hosting, database, edge functions, object storage | All customer data | Europe (per Lovable Cloud region selection) | UK IDTA / EU SCCs where applicable |
Lovable (static hosting for pocketpmo.co.uk) | Serving the SPA and static assets | No customer data at rest | Global edge (Cloudflare) | Not applicable |
AI
| Sub-processor | Purpose | Data | Region | Transfer mechanism |
|---|
| Lovable AI Gateway | Proxy to model providers; contractually excludes provider training on customer data | Prompt content chosen by the user; response | Routed via Lovable Cloud | UK IDTA / EU SCCs |
| Google (Gemini, via Lovable AI Gateway) | LLM | Prompt content | Per Google terms | UK IDTA / EU SCCs |
| OpenAI (via Lovable AI Gateway) | LLM | Prompt content | Per OpenAI terms | UK IDTA / EU SCCs |
| ElevenLabs | Voice transcription | Audio → transcript | Per ElevenLabs terms | UK IDTA / EU SCCs |
Payments
| Sub-processor | Purpose | Data | Region | Transfer mechanism |
|---|
| Stripe | Card processing, subscriptions | Payment metadata (no card data on our servers) | Per Stripe's terms | UK IDTA / EU SCCs |
Email
| Sub-processor | Purpose | Data | Region | Transfer mechanism |
|---|
| Resend (via Lovable Emails) | Transactional and auth email | Message metadata; content is per-message | Per Resend terms | UK IDTA / EU SCCs |
Identity and productivity
| Sub-processor | Purpose | Data | Region | Transfer mechanism |
|---|
| Google (OAuth sign-in) | Sign-in only | Profile claims | Per Google terms | Not applicable (sign-in) |
| Apple (Sign in with Apple) | Sign-in only | Profile claims | Per Apple terms | Not applicable (sign-in) |
| Microsoft (Microsoft Graph) | Calendar, presence, messaging integration | Per user OAuth scope | Per Microsoft terms | UK IDTA / EU SCCs |
Monitoring (optional / conditional)
| Sub-processor | Purpose | Data | Region | Transfer mechanism |
|---|
| Sentry | Error monitoring, when enabled | Stack traces, request context (scrubbed where possible) | Per Sentry terms | UK IDTA / EU SCCs |
Upstream sub-processors (engaged by Lovable Cloud on our behalf)
Pocket PMO runs on Lovable Cloud. Lovable maintains its own Trust Centre at https://trust.lovable.dev/ (SOC 2 Type I, ISO/IEC 27001:2022, GDPR). At the effective date of this register Lovable's published sub-processors are:
| Sub-processor | Purpose | Region |
|---|
| Google Cloud Platform (Cloud SQL, Firestore, App Engine) | Customer applications and databases | EU |
| Amazon Web Services (S3, SES, Bedrock) | Object storage, email transport, AI runtime | US |
| Cloudflare | Edge routing, DNS, Workers | Global |
| Anthropic (Claude) | AI model provider used within Lovable Cloud tooling | US |
| Turbopuffer | Indexing of source code and metadata | Per provider terms |
| Castle.io | Bot / fraud prevention and detection | Per provider terms |
The authoritative upstream list is maintained by Lovable and published on their Trust Centre. Pocket PMO monitors that list and reflects material changes here.
Notice mechanism
Customers are notified of new sub-processors via the Trust Centre at pocketpmo.co.uk/trust/subprocessors at least 30 days before the new sub-processor begins to process personal data.
Document history
| Version | Date | Change | Author |
|---|
| 1.0 | 13 Jul 26 | Initial register. | Pocket PMO |
| 1.1 | 15 Jul 26 | Added Lovable Cloud upstream sub-processor list (GCP EU, AWS US, Cloudflare, Anthropic, Turbopuffer, Castle.io) sourced from trust.lovable.dev. Removed H- placeholders now resolved. | Pocket PMO |
