Product Subprocessor List

Nineteen Point Two uses selected third-party providers to provide, host, secure, support and operate its products and hosted services, including WAIA and Outside Clarity.

Where these providers process Customer Personal Data on behalf of Nineteen Point Two, they are treated as subprocessors.

This list is maintained as the technical setup changes.

Current confirmed supplier posture

• Lovable should be treated as an active product subprocessor while WAIA, Outside Clarity or other relevant hosted applications are operated through Lovable Cloud or related Lovable services.
• Lovable is used under a Business plan for relevant hosted applications. Lovable’s Data Processing Agreement forms part of the applicable contractual terms and contains the UK GDPR Article 28 processor provisions required for personal-data processing.
• Lovable’s international-transfer framework uses the EU Standard Contractual Clauses, Modules 2 and 3, with the UK Addendum where applicable.
• Lovable’s published terms describe Lovable Cloud as a managed hosting and back-end environment that may include database hosting, authentication, file/object storage and API endpoints, provisioned on third-party infrastructure.
• Cloudflare should be treated as an infrastructure, routing and security provider where it is used for Nineteen Point Two websites or hosted products, including Outside Clarity.
• Supabase should be treated as a core infrastructure subprocessor in the relevant product chain where WAIA or Outside Clarity uses Supabase-backed authentication, database, storage or related back-end services.
• Where Supabase is provided through Lovable Cloud, Supabase can be described as part of Lovable’s underlying infrastructure/subprocessor chain. If Nineteen Point Two later controls a standalone Supabase project directly, Supabase should also be listed as Nineteen Point Two’s direct subprocessor.
• Lovable and/or Supabase should be treated as the current transactional email route for WAIA account and invite emails, and may support relevant Outside Clarity application emails, based on the current operational understanding.
• Lovable AI Gateway and configured OpenAI models may process Outside Clarity application content where needed to provide AI-supported review workflows. Lovable has confirmed that end-user content from published applications is not used to train Lovable models and that routed model providers are contractually prohibited from using that content to train their models.
• Stripe should be treated as a payment provider where Outside Clarity or another Nineteen Point Two product uses Stripe to process payments, invoices, checkout or related payment records.
• Microsoft 365 and Google Workspace should be treated as business operations suppliers for correspondence, documents and administration.
• Google Search Console is currently used for website search visibility/performance only. No Google Analytics, advertising pixel or behavioural analytics tool is currently known to be active.
• OpenAI, Anthropic, Gemini or similar AI model providers are not active WAIA runtime subprocessors based on current evidence and should not receive WAIA learner personal data unless a future feature is documented and approved.

Providers not intended to receive learner personal data

Some tools may be used for internal content creation, code generation, planning or marketing without intentionally receiving Customer Personal Data.

Customer Personal Data should not be entered into these tools unless:

• the tool is listed as an active subprocessor where required
• a data processing agreement is in place
• the processing purpose is documented
• the customer has been informed where required
• the feature or workflow has been approved internally

Subprocessor updates

Nineteen Point Two may update this list as providers are added, removed or replaced.

Where required by the Data Processing Agreement, customers will be given notice of material subprocessor changes and the opportunity to object on reasonable data protection grounds.

Contact

For subprocessor questions, contact ben@nineteenpointtwo.com.