DPA · Annex III

Subprocessors

The third parties DRIVUNO uses to deliver the service. None of them can read your file contents — they hold ciphertext or operational metadata only.

Notification

We notify Business customers at least 30 days before adding or replacing a subprocessor that processes customer metadata. Subscribe by emailing dpo@drivuno.com.

Infrastructure

Edge runtime, DDoS protection, CDN
Encrypted request bodies, IP addresses (logs)
Global (Anycast)
Production database and object storage holding ciphertext only. Provisioned and administered through the Lovable Cloud control plane.
Account records, ciphertext, sealed key envelopes, audit logs
EU (Ireland)
Build, deploy and administer the application and its managed infrastructure. No production customer content is stored on this platform, and no operator can decrypt customer content.
Application source, deployment metadata, infrastructure configuration
EU (Sweden)
Immutable off-site backup snapshots (encrypted before upload)
Encrypted snapshot archives only
EU (Amsterdam)

Communications

Transactional email delivery
Email addresses, message bodies we generate
EU / US
SMS for 2FA and recovery (opt-in)
Phone numbers, SMS body
Global

Billing

Card and SEPA payments
Billing identity, card metadata
EU / US
EU payments fallback
Billing identity, payment metadata
EU
Global payments fallback
Billing identity, payment metadata
EU / Global

Analytics

Privacy-preserving site analytics (no cookies, no PII)
Anonymized request URL, user agent, referrer
EU

For our full Data Processing Agreement, see /dpa. For data-residency commitments, see the sovereignty page.

Encrypted on your device · upload in 1 click
Upload