Matterlyt (Lucido LLC) engages the following sub-processors. All are bound by data-processing terms consistent with Art. 28 GDPR, and international transfers are covered by EU Standard Contractual Clauses where applicable.
| Sub-processor | Service | Data | Location | Safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Application & customer-data hosting; infrastructure-level DDoS protection | All product / customer data | Germany (EU) | Processed in the EU — no third-country transfer. |
| Cloudflare, Inc. | Marketing website (Cloudflare Pages), DNS, CDN | Website visitor data (IP, request metadata); DNS for our domains | USA / global edge | EU SCCs |
| PostHog Inc. | Consent-based website product analytics and heatmaps | Website usage events, device and browser metadata, interactions | EU Cloud (Frankfurt) | EU processing region; PostHog DPA |
| Chatwoot Inc. | Live chat / support widget on the website | Visitor name, email (if provided), chat messages, IP, page context | USA | EU SCCs |
AI processing — bring-your-own-account
Matterlyt operates on a bring-your-own-account model: each customer configures their own AI-provider account (their own API key, or an EU-region / self-hosted endpoint). The AI provider therefore processes content under the customer's own account and terms and is the customer's processor, not a Matterlyt sub-processor — which is why no AI provider is listed above. We do not send customer data to any AI provider on our own account, and do not use customer data to train models.
Change notification
We give customers prior notice of intended changes to this list (addition or replacement of a sub-processor), allowing them to object on reasonable data-protection grounds. To be notified, contact [email protected].