Lythe Subprocessor List

Final document set supplied 22 October 2026

Lythe Subprocessor List Effective date: 15 September 2026. Last updated: 21 October 2026. 1. Overview This provider disclosure identifies the current infrastructure, AI, billing, analytics, and data services used or connected in relation to Fraser Simulation Studio and related Lythe services (the “Services”). It distinguishes a provider’s operational use from its legal role. A provider is a Subprocessor only to the extent Lythe engages it to Process Customer Personal Data on a customer’s behalf and it is authorized under the applicable DPA. At launch, Lythe Inc. provides the Services to business customers in the United States. Any different contracting entity must be expressly identified in an executed customer agreement. The eleven current providers are AWS, Cloudflare, Google Cloud Vertex AI (Gemini models), Vercel, Stripe, PostHog, Mixpanel, Snowflake, Amplitude, FullStory, and Heap. This list should be read with the Lythe Privacy Policy, the applicable Terms of Service, and any applicable Data Processing Addendum (“DPA”) or customer agreement. 2. Definitions “Customer Personal Data” means personal data included in Customer Data and processed by Lythe on behalf of a customer through or in connection with the Services. “Subprocessor” means an affiliate or third-party service provider engaged by Lythe to process Customer Personal Data on behalf of a customer in connection with the Services. Capitalized terms not defined in this Subprocessor List have the meanings given in the applicable DPA, Terms of Service, Privacy Policy, Order Form, or customer agreement. 3. Current Providers and Processing Roles Only Permitted Inputs under the Terms of Service may reach Lythe: synthetic or truly anonymized information; necessary ordinary personal details incidental to authorized public-page evaluation; and real customer records, feedback or conversation material within a separate Data Approval completed before receipt or access. Lythe recommends synthetic sample records for authenticated testing. Safeguarded test accounts remain required; real customer records must remain hidden unless Lythe expressly approves the particular records, target access and safeguards in a Data Approval before receiving or accessing them. Approved ordinary personal information is protected by the DPA; sensitive and otherwise prohibited inputs remain excluded. Account, billing, security and Lythe-site analytics processing is described separately in the Privacy Policy. Listing a provider does not authorize a restricted input or make every provider a Subprocessor. Optional customer-controlled integrations operate under Customer’s own account or agreement. 4. Customer-Controlled Integrations A PostHog integration inside the product, together with Mixpanel, Snowflake, Amplitude, FullStory, and Heap, is optional and customer-controlled. Lythe does not contract for these product integrations on Customer’s behalf, and Fraser Simulation Studio functions without them. Customer selects, configures, and controls each integration under Customer’s own provider account or agreement. These providers are not Lythe Subprocessors for those integrations. Customer-controlled connections must supply only Permitted Inputs; real customer records, feedback or conversation materials require Data Approval covering the connection, necessary data and purpose before receipt or access. Lythe separately contracts for and controls PostHog for analytics and consent-gated session replay on Lythe’s landing website. 5. AI and Model Provider Restrictions Lythe does not permit third-party AI, model, transcription, or infrastructure providers to use Customer Personal Data or identifiable customer inputs processed through the Services to train their models. Where Lythe introduces another AI, transcription, or model provider that processes Customer Personal Data on Lythe’s behalf, Lythe will identify the provider in this Subprocessor List or otherwise provide the notice required by the applicable DPA or customer agreement. 6. International Data Transfers Relevant storage and access locations depend on each provider’s deployment and contractual arrangement; a United States customer launch does not establish United States-only processing. For optional customer-controlled integrations, storage and access locations follow Customer’s provider configuration. For Lythe-contracted providers, the location notes below describe the authorized arrangement. The applicable DPA and any required Transfer Record govern country-specific transfer details and safeguards. 7. Subprocessor Changes and Customer Objections Lythe may update this list as providers, features, or Processing arrangements change. For new or replacement Subprocessors Processing Customer Personal Data, Section 8 of the applicable DPA governs advance written notice, objections, resolution and any termination consequences. A public-list update alone does not replace required direct notice. The proposed provider’s purpose and relevant locations must be disclosed in that notice. Customer may object on reasonable data-protection grounds within fifteen (15) days after receipt of the notice, as provided in the DPA. The parties will work in good faith to resolve the objection. Payment and refund consequences follow the controlling agreement and applicable law; this list grants no automatic pro-rata refund. 8. Contact Company: Lythe Inc. Registered address: 2209 Van Ness Avenue, San Francisco, CA 94109 Privacy and DPA contact: team@lythe.ai

Current Provider Details Provider Processing details Amazon Web Services, Inc. (EC2, S3, Device Farm, Amplify) Primary purpose: Cloud infrastructure, compute, object storage, screenshots and test artifacts, device testing, hosting, networking, backups, and security. Data categories: Customer Data, uploaded materials, screenshots, artifacts, application data, logs, metadata, device identifiers, and backups. Role: Subprocessor Location / notes: United States and other configured AWS regions, depending on deployment. Cloudflare, Inc. Primary purpose: Content delivery, DNS, web security, traffic management, bot protection, and network performance. Data categories: IP addresses, request metadata, device/browser information, security events, and content transmitted through the network. Role: Subprocessor Location / notes: Global network; processing depends on traffic routing and configuration. Google LLC (Gemini through Vertex AI) Primary purpose: Gemini model services accessed through Google Cloud Vertex AI to process prompts, page content, screenshots, extracted text, uploaded documents and multimodal simulation inputs. Data categories: Permitted prompts, public-page content, screenshots, extracted text, files, images, approved necessary ordinary customer-record fields, feedback or conversation information and model inputs/outputs. These may include necessary ordinary personal details within accepted public-page scope or a prior Data Approval. Synthetic or truly anonymized information is used where feasible; sensitive and otherwise prohibited inputs remain excluded. Role: Subprocessor Location / notes: Lythe accesses Gemini models through Google Cloud Vertex AI using its company Google Cloud account with active billing. The applicable Google Cloud service terms and Cloud Data Processing Addendum govern this processing; locations follow the applicable service configuration and Google Cloud processing and transfer terms. Lythe does not authorize use of Customer Data or Customer Personal Data for Google’s model training, fine-tuning or product improvement. Optional sharing of prompts, responses and customer-content logs or datasets for those purposes is not enabled. Operational processing and retention remain subject to the applicable Google Cloud terms and Lythe’s DPA obligations. Vercel Inc. Primary purpose: Application hosting, deployment, content delivery, serverless infrastructure, and performance monitoring. Data categories: Account and usage data, application requests, IP addresses, technical logs, and limited Customer Data processed through hosted functions. Role: Subprocessor Location / notes: United States and global infrastructure, depending on routing and configuration. Stripe, Inc. Primary purpose: Payment processing, subscription management, invoicing, billing, fraud prevention, and payment-status webhooks. Data categories: Billing contacts, customer and subscription identifiers, transaction information, payment status, fraud-prevention data, and limited payment tokens. Role: Service provider Location / notes: United States and other locations used by Stripe. Stripe may act as an independent controller for certain payment data. PostHog, Inc. Primary purpose: Analytics, event measurement, debugging, and consent-gated session replay on Lythe’s landing website; optional customer-controlled analytics and replay integration inside the product. Data categories: For Lythe’s landing website, device/browser information, identifiers, page activity, navigation paths, interaction events, and session-replay data. Product-integration data is selected and controlled by Customer and must comply with the Permitted Inputs and Data Approval restrictions. Role: Service provider for Lythe’s landing website; optional customer-controlled product integration; not a Lythe Subprocessor for customer product inputs. Location / notes: Lythe’s landing website uses PostHog US Cloud subject to visitor consent choices. For a product integration, Customer controls the PostHog account, configuration, storage, and access locations. Mixpanel Primary purpose: Optional customer-controlled product analytics and persona-enrichment integration. Data categories: Permitted customer-selected inputs and analytics metadata, as configured by Customer. Real customer records, feedback or conversation information containing personal data require Data Approval covering the connection, necessary data and purpose before receipt or access; personal information outside that approval remains excluded. Role: Optional customer-controlled integration; not contracted by Lythe; not a Lythe Subprocessor; platform functions without it. Location / notes: Customer controls the provider account, configuration, storage, and access locations. Snowflake Primary purpose: Optional customer-controlled data storage and analytics integration. Data categories: Permitted customer-selected datasets and analytics metadata, as configured by Customer. Real customer records, feedback or conversation information containing personal data require Data Approval covering the connection, necessary data and purpose before receipt or access; personal information outside that approval remains excluded. Role: Optional customer-controlled integration; not contracted by Lythe; not a Lythe Subprocessor; platform functions without it. Location / notes: Customer controls the provider account, configuration, storage, and access locations. Amplitude Primary purpose: Optional customer-controlled product analytics and persona-enrichment integration. Data categories: Permitted customer-selected inputs and analytics metadata, as configured by Customer. Real customer records, feedback or conversation information containing personal data require Data Approval covering the connection, necessary data and purpose before receipt or access; personal information outside that approval remains excluded. Role: Optional customer-controlled integration; not contracted by Lythe; not a Lythe Subprocessor; platform functions without it. Location / notes: Customer controls the provider account, configuration, storage, and access locations. FullStory Primary purpose: Optional customer-controlled behavioral analytics and session-replay integration. Data categories: Anonymized customer-selected inputs and behavioral analytics metadata; identifiable raw replay is prohibited. Role: Optional customer-controlled integration; not contracted by Lythe; not a Lythe Subprocessor; platform functions without it. Location / notes: Customer controls the provider account, configuration, storage, and access locations. Heap Primary purpose: Optional customer-controlled product analytics and persona-enrichment integration. Data categories: Permitted customer-selected inputs and analytics metadata, as configured by Customer. Real customer records, feedback or conversation information containing personal data require Data Approval covering the connection, necessary data and purpose before receipt or access; personal information outside that approval remains excluded. Role: Optional customer-controlled integration; not contracted by Lythe; not a Lythe Subprocessor; platform functions without it. Location / notes: Customer controls the provider account, configuration, storage, and access locations.