Subprocessors

Effective date: 2026-07-22 Last updated: 2026-07-22

This page lists every third party that processes personal data on Lua's behalf in connection with the Lua platform and the Lua corporate operation. We publish this list to comply with GDPR Article 28(2) and the parallel commitment in our customer Data Processing Agreements (DPAs).

If you process personal data through Lua as a controller, this is the list of "subprocessors" your DPA refers to.

---

1. What is a subprocessor?

A subprocessor is a third party that Lua engages to help us deliver the Lua service and that, in the course of doing so, processes personal data on behalf of our customers (where Lua acts as processor) or on behalf of Lua itself (where Lua acts as controller).

Some entries on this list are subprocessors only in the GDPR-Art.-28 sense — they process customer-controlled personal data on customers' instructions. Others are also Lua's own data processors — they process personal data Lua itself controls (employees, leads, account billing contacts, security logs). We have flagged the role of each entry in the tables below to keep the picture honest.

Where a customer connects an agent to the customer's own third-party account (for example the customer's own commerce platform, support inbox, cloud LLM subscription, or booking system), that provider processes data on the customer's instructions under the customer's own agreement with it, and is not listed here as a Lua subprocessor.

This list is the authoritative public record of Lua's subprocessors. It is updated whenever a subprocessor changes and reviewed at least quarterly.

---

2. Our notification commitment

When we onboard a new subprocessor that will process customer personal data, we will give existing customers at least 30 days' written notice before the new subprocessor begins processing. Within that window, customers have the right to object to the change. If we cannot resolve the objection in a way that is acceptable to both parties, the customer may terminate the affected portion of the service in accordance with their contract.

Notification mechanism:

• Primary channel: email to the customer's designated DPA contact.
• Public channel: updates to this list at https://heylua.ai/legal/subprocessors.
• Subscribe to updates: email [email protected] with the subject "Subprocessor notifications" to be added to the notification distribution.

Material changes to this list are also recorded in the revision history at the foot of this page.

---

3. Customer-data subprocessors (Lua as processor)

These subprocessors process personal data that customers send into the Lua platform — principally agent conversation content (text and voice), channel message traffic, indexed RAG content, and end-user identifiers where customers route their end-users through Lua's auth layer. Lua is a processor for these activities under GDPR Article 28; our customers are the controllers.

3.1 Hosting and infrastructure

3.2 Large language model (LLM) and model providers

A model provider in this table receives conversation content only when a customer has selected that provider's model (or a routing policy that includes it) for their agent.

3.3 Data storage

3.4 Voice, meetings, and real-time communication

3.5 Messaging and email channels

Note (2026-07-22): Whapi.Cloud is being discontinued; personal data is being migrated to our official WhatsApp provider (the Meta WhatsApp Business Platform). Its removal from this list will appear in the next version.

3.6 Document and integration processing

3.7 Commerce and booking

3.8 Identity and notifications

3.9 Observability

---

4. Lua-controlled subprocessors (Lua as controller)

These subprocessors process personal data that Lua collects for its own purposes — employees, candidates, leads, billing contacts, support correspondents, website visitors, security telemetry. Lua is the controller for these activities.

4.1 Communications and collaboration

4.2 Issue tracking

4.3 HR, finance, and commercial operations

4.4 Analytics and marketing

4.5 Website embeds

---

5. How we manage subprocessors

Every subprocessor on this list is engaged under a written Data Processing Agreement that incorporates the applicable cross-border transfer mechanisms, and completes a security and privacy review before it processes personal data on Lua's behalf — except where this list states otherwise for a specific processor (for example, a processor that is being discontinued, or one for which the applicable cross-border transfer safeguards are still being executed). Subprocessors are re-reviewed on a recurring cadence, and this list is updated whenever a subprocessor changes.

---

6. Related documents and references

• Privacy Notice — https://heylua.ai/legal/privacy

---

7. Revision history