Service subprocessors
These process account or traffic data to run the Lume product.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Tinybird | Event storage and analytics queries | Traffic events (with truncated IP prefixes only), verification results, usage counters | United States (Google Cloud us-east4) |
| Railway | Ingest, enrichment and identification services; Postgres database; Redis cache and queue | Traffic events in transit (including the full IP, briefly), account and project configuration | United States (services in us-west2; Postgres and Redis in us-east4) |
| Vercel | Hosting for the Lume dashboard and its API | Account holder requests and dashboard data | United States (iad1, Washington, D.C.) |
| Cloudflare | Marketing site hosting and edge functions; network edge in front of ingest; the Cloudflare connector API | Requests in transit; for the connector, the analytics your Cloudflare account returns | Global edge network (requests are handled at the nearest Cloudflare location) |
| Clerk | Sign-in, user accounts and organizations | Account holder name, email address, sign-in and session data | United States |
| Stripe | Payments, invoicing and sales-tax calculation | Billing contact, billing address, payment method (held by Stripe), invoices | United States |
| Better Stack | Uptime monitoring, error tracking and service logs | Service health checks; error reports and logs, which carry no full IP addresses | United States |
| Resend | Delivery of account, usage and billing emails | Recipient email address and message content | United States |
Marketing site only
Used on lumetraffic.com, and only after you accept cookies. They never receive product or customer traffic data.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Google (Tag Manager, Analytics) | Marketing-site analytics, only after you accept cookies | Marketing-site page views and the identifiers Google Analytics sets | United States |
Data sources we run ourselves
These are not subprocessors: we download their data and use it on our own servers, and send them nothing.
- MaxMind (GeoLite2): country and network (asn) lookup. None: the database is downloaded and queried locally.
Changes
We give at least 30 days’ notice before adding or replacing a subprocessor, by updating this page and emailing account owners. You can object under our Data Processing Addendum. Questions: [email protected].