Sub-processors
Effective date: 1 November 2026 · Version 1.0 · Last updated: 1 November 2026
These are the third parties that process personal data on our behalf to provide Baaito. We announce changes to this list 30 days in advance.
Sub-processors used for every organisation
| Name | Purpose | Data location | Transfer mechanism |
|---|---|---|---|
| Lovable Labs Incorporated AB (Lovable Cloud; infrastructure Supabase Inc. on AWS) | Hosting, database, files, backups | EU – Ireland | Support access from the US possible: SCC / EU–US Data Privacy Framework |
| Microsoft Ireland Operations Ltd. – Azure AI Foundry | EU AI models | EU – Data Zone EU (Sweden Central) | None |
| Microsoft Ireland Operations Ltd. – Azure Container Apps, Container Registry | Microsoft 365 Gateway and Baaito AI Agent | EU – Poland Central | None |
| Microsoft – Azure Bot Service, Microsoft 365 / Teams, Entra ID | Message delivery and sign-in | Microsoft global service (EU Data Boundary) | Microsoft Data Protection Addendum |
| Cloudflare, Inc. | Lovable hosting network: content delivery, TLS and bot protection for baaito.app | Global edge network | SCC / EU–US Data Privacy Framework |
| WebSupport s.r.o. | E-mail delivery from noreply@baaito.app | EU – Slovakia | None |
| Lovable AI Gateway (OpenAI embedding model) | Search embeddings for uploaded and connected sources | USA / global | SCC / EU–US Data Privacy Framework |
Optional – only when an organisation enables them
| Name | Purpose | Data location | Transfer mechanism |
|---|---|---|---|
| OpenRouter, Inc. (and the model providers it routes to) | AI models, used depending on the enabled model | USA / global | SCC |
| Lovable AI Gateway (Google Gemini and other models) | AI models, used depending on the enabled model | USA / global | SCC / EU–US Data Privacy Framework |
| ElevenLabs Inc. | Voice playback, only when voice is used | USA | SCC |
Changes to this list
We inform organisation administrators of any new or replaced sub-processor at least 30 days in advance. Administrators may object as described in the Data Processing Agreement.