Sub-processors
Last updated 29 July 2026
These are every third party that processes personal data on our behalf. There are four, and none of them is an analytics, advertising or tracking service — Lazy PA uses none.
Each is bound by a data processing agreement and may use the data only to provide its service to us. This page is our standing notice under Article 28(2) of the GDPR: we update it before a new provider starts processing, so it is worth checking if you want to stay current.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| OpenAI | Language-model processing and embeddings — understanding what you type, answering questions about your own material, and generating the vectors that power search. | The text of the message you send, plus the material from your account needed to answer it (notes, tasks, people, events, document extracts). Voice notes reach OpenAI as transcribed text. | United States |
| Deepgram | Speech-to-text transcription of voice notes. | The audio you record, and only when you record something. | United States |
| Resend | Transactional email — sign-in links and codes, and security notices such as a password change. | Your email address and the contents of that email. No marketing email is sent. | United States |
| DigitalOcean | Hosting. Runs the application server and the PostgreSQL database, and stores uploaded files and backups in DigitalOcean Spaces object storage. | Everything stored in the service, as the underlying infrastructure provider — it runs the server, the database and the object storage. | United States — San Francisco (server, database and object storage) |
How this list is kept honest
The application server runs behind an outbound allowlist: it can only open connections to an explicitly permitted set of hosts, and everything else is refused at the network layer. That list and this page describe the same thing, which means a provider missing from here could not quietly start receiving data — it would simply be unable to connect.
International transfers
All four providers process data in the United States — and so does the service itself: the application server and the PostgreSQL database run in DigitalOcean’s San Francisco region, alongside the object storage. Nothing is processed in the EEA, notwithstanding that Lazy Cat Media OÜ is an Estonian company.
These transfers rely on the Standard Contractual Clauses in each provider’s data processing agreement, and where applicable on the EU–US Data Privacy Framework. Section 6 of the Privacy Policy covers this in full.
Objecting to a sub-processor
Write to info@lazycat.media. We will explain why the provider is needed and whether an alternative exists. If we cannot resolve it, your remedy is to export your data and close your account — we cannot operate Lazy PA without the providers above.