| Provider | Purpose | Data involved |
|---|---|---|
| Lemon Squeezy | Merchant of record: checkout, cards, invoicing, sales tax and VAT, refunds | Billing contact, email, country, amount, order and subscription ids. Card numbers stay with Lemon Squeezy and its processors. |
| Mailgun | Transactional email (sign-in codes, invites, billing notices) | Name, email address, and email content |
| Google / Microsoft / Apple | Sign-in, only if you choose it | Name, email address, and account identifier |
| Cloud hosting (Postgres, Redis) | Application hosting, primary database, cache and job locks | Account, workspace content, billing references, and logs |
| Cloudflare | CDN, R2 object storage, DNS and network protection | IP address, request metadata, and files you upload |
| Sentry | Error monitoring | Error reports, device and app details, and account identifier. Workspace content is scrubbed where practical. |
Integrations you connect (GitHub, GitLab, Jira, Slack, Sentry) receive and send data at your direction under their own policies. For processor terms, download the DPA.