Sub-Processors
Last updated: August 19, 2026
This page lists the third-party data processors ("Sub-Processors") that LunaRabbit Inc. engages to process customer personal data on our behalf, together with the category of data they receive and the relevant Data Processing Agreement (DPA) or privacy policy. It supplements Section 3 of our Privacy Policy and discharges our disclosure obligations under Article 26 (restrictions on entrusted processing) and Article 28-8 (transfer of personal data abroad) of Korea's Personal Information Protection Act, as well as the US CCPA and other applicable data protection law.
Cross-border transfer notice. Most of the sub-processors below process personal data outside the Republic of Korea (primarily the United States); the processing country for each is given in the Region column. For users in Korea these transfers are made under Article 28-8(1)3(a) of the Personal Information Protection Act — entrusted processing or storage necessary to perform our contract with you, disclosed through this page and our Privacy Policy — and no separate transfer consent is collected. The full set of particulars required by Article 28-8(2), including how to refuse a transfer and what refusing means, is in Section 4 of the Privacy Policy.
Our Services include LunaRabbit Chat (AI chat assistant) and LunaRabbit Office (AI productivity tools for Microsoft Office and Google Workspace). Where a sub-processor applies only to a specific product, that product is noted in the Purpose column.
1. AI Model Processors
These processors receive your conversation text and document content to generate model responses. The text model providers operate under commercial API terms whose default behavior is no training on customer data. Two providers are exceptions, and their terms are described in the table. fal.ai (video generation) permits anonymized or aggregated data derived from customer input to be used for its own services and AI model development. RunPod (GPU compute for self-hosted inference) permits data in that form to be used for service improvement. Neither offers an opt-out. For fal.ai we mitigate this by disabling payload storage on every request we send.
| Sub-Processor | Purpose | Data Categories | Region | DPA / Policy |
|---|---|---|---|---|
| OpenAI, L.L.C. | GPT model inference | Conversation text, document content, system prompts | United States | Privacy · DPA |
| Anthropic, PBC | Claude model inference | Conversation text, document content, system prompts | United States | Privacy · Commercial Terms |
| Google LLC | Gemini model inference, Gemini text-to-speech, and Veo video generation | Conversation text, document content, video generation prompts | United States (multi-region) | DPA |
| Together Computer, Inc. (Together AI) | Open-source model inference (e.g. Qwen) for Deep Research and chat | Conversation text, research queries, fetched page summaries, system prompts — Zero Data Retention enabled; prompt storage and third-party passthrough are both disabled at the organization level | United States | Privacy · Terms (ZDR §3.2) · DPA available on request |
| Fireworks AI, Inc. | Open-source model inference — standby path used only if Together AI is unavailable. No traffic under normal operation | Conversation text and system prompts, only if failover occurs — Zero Data Retention applies by default, and its terms prohibit using customer data to train models | United States | Privacy · Terms · DPA (incorporated without signature) |
| Features and Labels, Inc. (fal.ai) | AI video generation inference (LTX video model) | Video generation prompts (translated to English), optional reference images for image-to-video | United States | Privacy · Terms · DPA (incorporated by reference into its Terms) — note: its Terms permit anonymized or aggregated data derived from customer input to be used for its own services and AI model development, with no opt-out; we disable payload storage on every request |
| RunPod, Inc. | GPU compute for self-hosted model inference (SGLang). Engaged only when self-hosted inference is enabled; not active by default | Conversation text in transit for inference — not persisted by us on the instance | United States (Secure Cloud only) | Privacy · DPA (SCC Modules 2/3) — note: its Terms grant a licence to use aggregated and anonymised content for service improvement, with no opt-out; no zero-retention commitment is offered |
2. Web Search, Fetch, and Research Processors
These processors are invoked when a real-time information lookup, URL extraction, or AI-powered research is necessary.
| Sub-Processor | Purpose | Data Categories | Region | DPA / Policy |
|---|---|---|---|---|
| Serper LLC (serper.dev) | Google Search proxy on lower-cost search tiers | Search query strings | United States | Privacy |
| Jina AI GmbH (r.jina.ai) | URL content fetch and text extraction (webFetch tool) for URLs you have explicitly referenced | Target URL string, page content fetched on our behalf | Singapore / Germany | Privacy |
| Perplexity AI, Inc. | AI-powered search and synthesis (Deep Research suggestions, Office Solver mode) | Search query strings | United States | Privacy · DPA available on request |
3. Financial Data Processors
These processors provide financial and economic data when finance-related tools are invoked. Only ticker symbols or series identifiers are transmitted; no personal data is shared.
| Sub-Processor | Purpose | Data Categories | Region | DPA / Policy |
|---|---|---|---|---|
| Finnhub | Financial data API — company fundamentals (P/E, EPS, market cap) | Ticker symbols only (no PII) | United States | Terms of Service |
| Twelve Data | Financial data API — stock quotes, historical OHLCV charts (US, crypto) | Ticker symbols only (no PII) | United States | Terms of Service |
| Federal Reserve Bank of St. Louis (FRED) | Economic data API — economic indicators (GDP, CPI, interest rates) | Series IDs only (no PII) | United States | Legal |
4. Infrastructure Processors
These processors host our infrastructure and receive request metadata. They do not see decrypted conversation content beyond what TLS termination requires, with one exception: E2B executes uploaded files and extracted data inside its sandbox and therefore processes that content directly.
| Sub-Processor | Purpose | Data Categories | Region | DPA / Policy |
|---|---|---|---|---|
| Amazon Web Services, Inc. | EC2 compute, RDS PostgreSQL, ElastiCache Redis, WAF | Application data at rest, request metadata, session cache, logs | ap-northeast-2 (Seoul) | Service Terms · DPA |
| Cloudflare, Inc. | CDN, DNS, TLS termination, DDoS protection, Pages hosting, R2 object storage (generated images, user files), Workers (image delivery via img.lunarabbit.ai) | IP addresses, request paths, timestamps, cached static assets, generated image files | Global edge network | DPA |
| Google LLC (Firebase Cloud Messaging) | Push notification delivery to Android devices | Device push tokens, notification title/body | United States | DPA |
| Apple Inc. (APNs) | Push notification delivery to iOS devices | Device push tokens, notification title/body | United States | Privacy |
| FoundryLabs, Inc. (E2B) | Secure code execution sandbox (Office Builder mode — runs generated Python against your data in an isolated Firecracker microVM) | Spreadsheet files you upload (XLSX/CSV), cell data extracted for processing, and the generated code — file contents may contain personal data depending on what you upload | United States | Terms of Service — note: its Terms grant a perpetual, irrevocable, worldwide licence to use and exploit submitted materials — scoped to providing the service and operating its business — with no opt-out; no DPA is in place |
| Qdrant Solutions GmbH (Qdrant Cloud) | Vector database for fewshot retrieval — stores de-identified embeddings only, never raw text | Embedding vectors (de-identified) | Frankfurt (EU) | Privacy |
| Google LLC | Google Accounts identity provider for Single Sign-On | Email, display name, profile picture at sign-in | United States (multi-region) | Privacy · DPA |
| Microsoft Corporation | Azure AD identity provider for Single Sign-On; Microsoft Graph API for user profile retrieval; Office.js host for Office Add-in surface | Email, display name, tenant ID, profile picture URL at sign-in | United States (multi-region) | DPA |
| Resend, Inc. | Transactional email delivery (account verification, team invitations, security notifications) | Email address, email subject and body | United States | Privacy · DPA |
5. Payment Processors
Payment processors are engaged when paid subscriptions are active. The following processors handle subscription billing, tax compliance, and payment processing.
| Sub-Processor | Purpose | Data Categories | Region | DPA / Policy |
|---|---|---|---|---|
| Paddle.com Market Limited | Merchant of Record for global subscription billing; tax handling, payment method support (cards, KakaoPay, Naver Pay) | Name, email, billing address, payment method, transaction history | United Kingdom (with sub-processors in US/EU) | DPA |
6. Notification of New Sub-Processors
We will provide at least 30 days' advance notice on this page before adding a new sub-processor that materially changes the categories of data we share. Users who are subscribed to update notifications (via [email protected]) will also receive email notice. If you object to a new sub-processor, you may terminate your subscription before that sub-processor begins processing your data.
7. Internal Access
In addition to the sub-processors above, authorized LunaRabbit personnel access stored customer data only for limited operational purposes — debugging regressions, investigating user-submitted error reports, security incident response, and statutorily required disclosures. Access is gated by single sign-on, IP allowlist, and logged for audit. This human access is described further in Section 3.5 of the Privacy Policy.
8. Contact
For questions about our sub-processors or to request a copy of any DPA we cannot share publicly, contact [email protected].
Operator: LunaRabbit Inc., a Delaware corporation. Mailing address: 131 Continental Drive, Suite 305, Newark, DE 19713, United States.