Subprocessor List

This Subprocessor List identifies affiliates and third-party service providers that Lythe Inc. or its applicable affiliate, including Lythe Pte. Ltd. (collectively and as applicable, “Lythe”), may engage to process Customer Personal Data in connection with Fraser Simulation Studio and related Lythe services (collectively, the “Services”).

Lythe Inc. provides Lythe’s self-serve Services worldwide. Lythe Pte. Ltd., Lythe’s Singapore subsidiary, may process Customer Personal Data as an affiliate subprocessor or may separately provide contracted Services where expressly identified in an applicable Order Form, customer agreement, Terms of Service, or other written agreement.

This list should be read with the Lythe Privacy Policy, the applicable Terms of Service, and any applicable Data Processing Addendum (“DPA”) or customer agreement.

• “Customer Personal Data” means personal data included in Customer Data and processed by Lythe on behalf of a customer through or in connection with the Services.
• “Subprocessor” means an affiliate or third-party service provider engaged by Lythe to process Customer Personal Data on behalf of a customer in connection with the Services.
• Capitalized terms not defined in this Subprocessor List have the meanings given in the applicable DPA, Terms of Service, Privacy Policy, Order Form, or customer agreement.

The providers below may process Customer Personal Data depending on the features, integrations, deployment environment, and customer configuration used. A provider processes only the categories of data reasonably necessary for the stated purpose. “Subprocessor” identifies a provider engaged by Lythe to process Customer Personal Data. “Service provider” identifies a provider used to operate a feature or business function; it is a Subprocessor only to the extent it processes Customer Personal Data for Lythe.

The following providers may receive Customer Data when a customer selects, configures, and controls the relevant integration under its own account or agreement. In that case, the provider ordinarily processes data under the customer’s direct instructions and contractual relationship and is not a Lythe Subprocessor. Lythe will add a provider to Section 3 when it independently engages that provider to process Customer Personal Data on Lythe’s behalf.

Lythe does not permit third-party AI, model, transcription, or infrastructure providers to use Customer Personal Data, customer-provided call recordings, transcripts, research data, simulation inputs, AI persona outputs, or other personal data processed through the Services to train their models.

Where Lythe introduces another AI, transcription, or model provider that processes Customer Personal Data on Lythe’s behalf, Lythe will identify the provider in this Subprocessor List or otherwise provide the notice required by the applicable DPA or customer agreement.

Customer Personal Data may be processed in the United States, Singapore, and other countries in which authorized Subprocessors operate. Where required by applicable law or the applicable DPA, Lythe will implement appropriate safeguards for cross-border transfers, which may include contractual protections, data processing agreements, standard contractual clauses, transfer assessments, or other recognized transfer mechanisms.

Lythe may update this Subprocessor List as providers, features, or processing arrangements change. Where required by an applicable DPA or customer agreement, Lythe will provide notice of an intended addition or replacement of a Subprocessor through an updated Subprocessor List, email, product notice, or another agreed method at least thirty (30) days before the new Subprocessor begins processing Customer Personal Data, unless an emergency replacement is reasonably necessary for security, availability, or service continuity.

A customer may object to a new Subprocessor on reasonable data-protection grounds by contacting Lythe within fifteen (15) days after receiving notice. Lythe and the customer will work in good faith to address the objection in accordance with the applicable DPA or customer agreement.

• Company: Lythe Inc.
• Privacy and DPA contact: team@lythe.ai
• Singapore affiliate: Lythe Pte. Ltd.

Amazon Web Services, Inc. (EC2, S3, Device Farm, Amplify)

• Primary purpose: Cloud infrastructure, compute, object storage, screenshots and test artifacts, device testing, hosting, networking, backups, and security.
• Data categories: Customer Data, uploaded materials, screenshots, artifacts, application data, logs, metadata, device identifiers, and backups. Role: Subprocessor Location / notes: United States and other configured AWS regions, depending on deployment.

Cloudflare, Inc.

• Primary purpose: Content delivery, DNS, web security, traffic management, bot protection, and network performance.
• Data categories: IP addresses, request metadata, device/browser information, security events, and content transmitted through the network. Role: Subprocessor Location / notes: Global network; processing depends on traffic routing and configuration.

Google LLC (Gemini and Vertex AI)

• Primary purpose: AI and model services used to process prompts, page content, screenshots, extracted text, uploaded documents, and multimodal simulation inputs.
• Data categories: Prompts, page content, screenshots, extracted text, uploaded files, audio, images, and model inputs/outputs. Role: Subprocessor Location / notes: United States and configured Google Cloud regions. Lythe does not permit use of Customer Personal Data to train third-party models.

Google LLC (Google Workspace, OAuth, Forms, Calendar, Fonts)

• Primary purpose: Email delivery and mailbox connectivity, sign-in, misuse reports, startup applications, booking, and browser-delivered fonts.
• Data categories: Email addresses, run summaries, OTP message bodies, sign-in identity, report/application data, booking information, visitor IP address and browser/user-agent data. Role: Service provider Location / notes: Google services and global infrastructure. Customer-connected mailbox data is accessed only on Customer instructions.

Microsoft Corporation (Azure Blob)

• Primary purpose: Storage of simulation artifacts and related cloud platform services where used.
• Data categories: Stored artifacts, Customer Data, uploaded materials, application data, logs, metadata, and backups. Role: Subprocessor Location / notes: United States and other configured Azure regions, depending on deployment.

MongoDB, Inc. (Atlas)

• Primary purpose: Application database, user and account records, traces, trace nodes, audit logs, and usage records.
• Data categories: Users, account information, trace data, audit logs, usage records, application data, and technical metadata. Role: Subprocessor Location / notes: Configured MongoDB Atlas region(s); trace payloads may be encrypted before insertion.

Aiven Oy (Valkey)

• Primary purpose: Rate-limit counters and transient application cache services.
• Data categories: Rate-limit counters, client identifiers, and limited technical metadata. Role: Subprocessor Location / notes: Configured Aiven region(s); TLS-encrypted Redis/Valkey protocol.

Vercel Inc.

• Primary purpose: Application hosting, deployment, content delivery, serverless infrastructure, and performance monitoring.
• Data categories: Account and usage data, application requests, IP addresses, technical logs, and limited Customer Data processed through hosted functions. Role: Subprocessor Location / notes: United States and global infrastructure, depending on routing and configuration.

Stripe, Inc.

• Primary purpose: Payment processing, subscription management, invoicing, billing, fraud prevention, and payment-status webhooks.
• Data categories: Billing contacts, customer and subscription identifiers, transaction information, payment status, fraud-prevention data, and limited payment tokens. Role: Service provider Location / notes: United States and other locations used by Stripe. Stripe may act as an independent controller for certain payment data.

AgentMail, Inc.

• Primary purpose: Email delivery and receipt for test personas and target-site communications.
• Data categories: Email messages and headers, recipient/sender addresses, and limited technical metadata. Role: Subprocessor Location / notes: United States; supporting service providers may process in the United States and European Union, as disclosed by AgentMail, Inc. HTTPS API transport.

PostHog, Inc.

• Primary purpose: Product analytics, event analytics, debugging, feature usage measurement, and session replay where enabled.
• Data categories: Device/browser information, identifiers, page activity, navigation paths, interaction events, feature usage, and session-replay data. Role: Subprocessor Location / notes: PostHog US Cloud. Analytics and session replay are subject to applicable consent choices.

Lythe Pte. Ltd.

• Primary purpose: Engineering, customer support, operations, administration, and security services required to provide the Services.
• Data categories: Customer Personal Data, account information, support records, technical logs, and other data necessary to provide the Services. Role: Affiliate subprocessor Location / notes: Singapore. Acts as an affiliate subprocessor of Lythe Inc. unless separately identified as the contracting entity.

Microsoft Corporation (Teams)

• Primary purpose: Customer-authorized Teams integration and inbound bot/webhook events.
• Data categories: Finding summaries, run updates, and inbound signed event data. Role: Customer-authorized integration Location / notes: Microsoft 365/Teams environment selected and controlled by Customer.

Salesforce, Inc. (Slack)

• Primary purpose: Customer-authorized Slack integration and OAuth-based message/event delivery.
• Data categories: Run updates, findings, summaries, and inbound signed event data. Role: Customer-authorized integration Location / notes: Slack workspace selected and controlled by Customer.

Atlassian Pty Ltd (Jira)

• Primary purpose: Customer-authorized issue-tracker integration.
• Data categories: Finding descriptions, screenshots, ticket content, and associated metadata. Role: Customer-authorized integration Location / notes: Data is sent only to the customer-selected Jira instance after browser OAuth.

Linear Orbit, Inc. (Linear)

• Primary purpose: Customer-authorized issue-tracker integration.
• Data categories: Ticket content, findings, screenshots, and associated metadata. Role: Customer-authorized integration Location / notes: Server-side GraphQL connection over HTTPS after customer authorization.

GitHub, Inc.

• Primary purpose: Customer-authorized source-code repository and issue integration.
• Data categories: Repository reads, issue content, and write-back content selected by Customer. Role: Customer-authorized integration Location / notes: Server-side REST connection through customer OAuth or personal access token.

Figma, Inc.

• Primary purpose: Customer-authorized design-file integration.
• Data categories: Design-file reads and associated metadata selected by Customer. Role: Customer-authorized integration Location / notes: Server-side REST connection using the customer-authorized access token.

Wikimedia Foundation, Inc. and Icons8 LLC

• Primary purpose: Browser-delivered images and icons on the integrations page.
• Data categories: Visitor IP address, referrer, browser/user-agent data, and standard browser request metadata. Role: Browser-direct provider Location / notes: A visitor’s browser requests these assets directly; neither provider is engaged to process Customer Data for Lythe.