This page lists the sub-processors that LostChurn engages to deliver its payment recovery services. This list is maintained in accordance with GDPR Article 28 and is referenced by our Data Processing Agreement (DPA). We update this page whenever a sub-processor is added, removed, or materially changed.
Current Sub-Processors
| Sub-Processor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. | Edge computing, CDN, DNS, storage (KV, R2) | Request metadata, cached data | Global (edge), US (control plane) | EU-US DPF, SCCs |
| Amazon Web Services | Database hosting (SpacetimeDB), backups | All application data (encrypted) | EU (Frankfurt, eu-central-1) | SCCs, DPF |
| Resend, Inc. | Transactional email delivery | Email addresses, email content | EU (Ireland, eu-west-1) | SCCs |
| Twilio, Inc. | SMS and voice delivery | Phone numbers, message content | US | EU-US DPF, SCCs |
| Stripe, Inc. | Payment processing, billing | Payment metadata (no card numbers) | US/EU | EU-US DPF, SCCs |
| Clerk, Inc. | User authentication, session management | User email, name, session tokens | US | EU-US DPF |
| PostHog, Inc. | Product analytics, session replay | Usage data, anonymized behavior | EU (Frankfurt) | EU-US DPF |
| Functional Software (Sentry) | Error monitoring | Stack traces, request metadata (PII scrubbed) | US | EU-US DPF |
| GitHub, Inc. | Code hosting, CI/CD | Source code (no PII) | US | EU-US DPF |
Change Notification Policy
- LostChurn will notify merchants at least 30 days before engaging a new sub-processor or materially changing an existing one.
- Notifications are sent via email to the account owner's registered email address and posted to this page.
- The notification will include the sub-processor's name, purpose, data categories processed, and data location.
Objection to New Sub-Processors
Merchants may object to a new or changed sub-processor within 30 days of receiving notification. To exercise this right:
- Send a written objection to dpa@lostchurn.com within 30 days of notification, stating the specific grounds for objection.
- LostChurn will work in good faith to address the concern, which may include offering an alternative configuration that avoids the objected-to sub-processor.
- If no mutually acceptable resolution is found, the merchant may terminate the affected services without penalty by providing written notice.
Related Documents
Questions
For questions about our sub-processors or data processing practices, contact us at dpa@lostchurn.com.