Subprocessors
Last updated: 19 July 2026
This is the complete list of third parties that process personal data on behalf of Lexstream, what each one receives, and where it is processed. It is the authoritative list referred to in our Privacy Policy.
Lexstream is hosted in the European Union (Ireland). Your account data, saved articles, notes and preferences are stored in the EU and are not replicated outside it. The subprocessors below that are located in the US receive only the specific, limited data described in each row.
Infrastructure
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| Heroku (Salesforce) | Application hosting and PostgreSQL database | All account, preference, usage and content data | EU — Ireland |
| Vercel | Frontend hosting and content delivery | Page requests; visitor IP address processed at the edge | Global edge network (US company) |
| Cloudflare | DNS, content delivery, bot mitigation and security | Page requests; visitor IP address processed at the edge | Global edge network (US company) |
AI and search
This is the section most customers ask about, so we are specific. Article content sent for AI classification and summarisation carries no user data. Search is the one place where text you type leaves our infrastructure.
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| Anthropic (Claude) | Classification, summarisation and editorial generation of published legal content | Published source-article text only. No user data and no user identifier is sent. | US |
| Voyage AI | Semantic search — converting queries to embeddings and re-ranking results | The search text you type, including the keywords of any Custom Lens you open, and help-centre search queries. No user identifier is attached to these requests. | US |
| ElevenLabs | Text-to-speech narration for the Morning Brief audio briefing | The generated briefing text only — an editorial summary of published legal content. No user data and no user identifier is sent. We call ElevenLabs from our server and serve the audio ourselves, so your browser never contacts them and your IP address is not exposed to them. | US |
Authentication
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| LearnWorlds | Hosts Lexstream Academy, sends its course and account notices, and provides single sign-on between the two products | Email address, name and profile data; and, for learners, course enrolments, progress, assessment results, certificates, and anything you post or submit inside a course. | EU |
| WorkOS | Enterprise SSO / SAML (Enterprise plans only) | Email address, name, organisation identifier | US |
| Sign in with Google (optional) | Email address, name, profile picture. Google acts as an independent controller for the sign-in itself. | US | |
| Apple | Sign in with Apple (optional, iOS) | Email address (or Apple private-relay address) and name. Apple acts as an independent controller for the sign-in itself. | US |
| Social sign-in on Lexstream Academy only (optional) | Email address and basic profile information, if you choose it to sign in. LinkedIn acts as an independent controller for the sign-in itself. | US |
Payments
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| Stripe | Web subscription payments | Email address, name, Stripe customer ID. Card details are collected by Stripe directly and never reach Lexstream. | US / Ireland |
| RevenueCat | iOS in-app purchase entitlements | Pseudonymous app user ID, purchase and entitlement status | US |
| Apple (App Store) | iOS in-app purchase processing | Purchases are processed entirely by Apple. Lexstream receives entitlement status only, never payment details. | US |
Email and notifications
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| Resend | Transactional emails and digest / newsletter delivery | Email address, email content | US |
| Apple Push Notification service (APNs) | iOS push notification delivery | Device push token, notification content | US |
| MailerLite | Marketing email and newsletters, and measuring whether they were opened or clicked | Email address, name, and engagement with our marketing emails. Used only where you have opted in. | EU |
Content ingestion
These services help us retrieve public legal source material. They receive no user data.
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| ScrapingBee | Retrieving publicly-available pages from official sources (gazettes, courts, regulators) | No personal data. Requests are outbound to public sources only; no user data is included. | US |
Product feedback
Only used if you actively submit a suggestion. We store your suggestion in our own EU database and send a copy to our task tracker so we can act on it.
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| ClickUp | Tracking suggestions you submit (a new source, or a product improvement) | The content of the suggestion you submit, and your email address so that we can follow up. Sent from our servers — your browser never contacts ClickUp. | US |
Third parties your browser contacts
These are not subprocessors in the strict sense — we do not send them your data. But loading our pages causes your browser to connect to them, which means they receive your IP address. We list them for completeness.
| Subprocessor | Purpose | Personal data processed | Location |
|---|---|---|---|
| Google reCAPTCHA v3 | Bot protection on sign-up and sign-in | Browser interaction signals and IP address, collected directly by Google | US |
| Google Fonts | Web fonts (Sora, Montserrat, JetBrains Mono) | Fonts are served from Google’s CDN, so your browser’s request — including your IP address — reaches Google. | US |
| Synthesia | Product video on the public marketing site, and AI-presenter video inside Academy courses | Visitor IP address (video player embed). Course video is generated before anyone enrols — no learner data is sent to Synthesia. | US |
| Spotify | Embedded podcast playback in Academy courses | Visitor IP address (audio player embed) | US / EU |
| YouTube (privacy-enhanced mode) | Video embeds | Visitor IP address. Loaded via youtube-nocookie.com, which does not set tracking cookies unless the video is played. | US |
What we do not send to any third party
- Private notes — never leave our infrastructure and are never sent to any AI service.
- Your reading behaviour — personalisation is computed entirely inside our EU database. No reading or engagement data is sent to any third party.
- Team feeds and curation — remain within our EU infrastructure.
- Your password — stored only as a bcrypt hash and never transmitted anywhere.
- Your data, to advertisers or data brokers — we do not sell, rent or share personal data, and we run no advertising or analytics trackers.
Transfers outside the EEA
Lexstream itself runs in the EU. Where a provider above is located outside the European Economic Area, we rely on the safeguards set out in that provider's data processing terms. For details of the safeguards that apply to a specific provider, contact privacy@lexlens.io.
Changes to this list
We update this page whenever we add or remove a subprocessor. Enterprise customers with a signed Data Processing Agreement receive advance notice of new subprocessors in accordance with that agreement. To be notified of changes, contact privacy@lexlens.io.