Sub-Processors
Last updated: July 4, 2026
This page lists the third-party data processors ("Sub-Processors") that LunaRabbit Inc. engages to process customer personal data on our behalf, together with the category of data they receive and the relevant Data Processing Agreement (DPA) or privacy policy. It supplements Section 3 of our Privacy Policy and supports our obligations under the US CCPA, Korea's PIPA Article 26, and other applicable data protection law.
Our Services include LunaRabbit Chat (AI chat assistant) and LunaRabbit Office (AI productivity tools for Microsoft Office and Google Workspace). Where a sub-processor applies only to a specific product, that product is noted in the Purpose column.
1. AI Model Processors
These processors receive your conversation text and document content to generate model responses. All operate under their commercial API terms; default behavior is no training on customer data.
| Sub-Processor | Purpose | Data Categories | Region | DPA / Policy |
|---|---|---|---|---|
| OpenAI, L.L.C. | GPT model inference | Conversation text, document content, system prompts | United States | Privacy · DPA |
| Anthropic, PBC | Claude model inference | Conversation text, document content, system prompts | United States | Privacy · Commercial Terms |
| Google LLC | Gemini model inference, Gemini text-to-speech, and Veo video generation | Conversation text, document content, video generation prompts | United States (multi-region) | DPA |
| Together Computer, Inc. (Together AI) | Open-source model inference (e.g. Qwen) for Deep Research and chat | Conversation text, research queries, fetched page summaries, system prompts | United States | Privacy · DPA |
| Features and Labels, Inc. (fal.ai) | AI video generation inference (LTX video model) | Video generation prompts (translated to English), optional reference images for image-to-video | United States | Privacy · Terms |
| ElevenLabs, Inc. | Text-to-speech narration for AI-generated storybooks (read-aloud audio) | AI-generated storybook text (narration lines; no user account data) | United States | Privacy · Terms |
2. Web Search, Fetch, and Research Processors
These processors are invoked when a real-time information lookup, URL extraction, or AI-powered research is necessary.
| Sub-Processor | Purpose | Data Categories | Region | DPA / Policy |
|---|---|---|---|---|
| Serper LLC (serper.dev) | Google Search proxy on lower-cost search tiers | Search query strings | United States | Privacy |
| Jina AI GmbH (r.jina.ai) | URL content fetch and text extraction (webFetch tool) for URLs you have explicitly referenced | Target URL string, page content fetched on our behalf | Singapore / Germany | Privacy |
| Perplexity AI, Inc. | AI-powered search and synthesis (Office Solver mode) | Search query strings | United States | Privacy · DPA available on request |
3. Financial Data Processors
These processors provide financial and economic data when finance-related tools are invoked. Only ticker symbols or series identifiers are transmitted; no personal data is shared.
| Sub-Processor | Purpose | Data Categories | Region | DPA / Policy |
|---|---|---|---|---|
| Finnhub | Financial data API — company fundamentals (P/E, EPS, market cap) | Ticker symbols only (no PII) | United States | Terms of Service |
| Twelve Data | Financial data API — stock quotes, historical OHLCV charts (US, crypto) | Ticker symbols only (no PII) | United States | Terms of Service |
| Federal Reserve Bank of St. Louis (FRED) | Economic data API — economic indicators (GDP, CPI, interest rates) | Series IDs only (no PII) | United States | Legal |
4. Infrastructure Processors
These processors host our infrastructure and receive request metadata. They do not see decrypted conversation content beyond what TLS termination requires.
| Sub-Processor | Purpose | Data Categories | Region | DPA / Policy |
|---|---|---|---|---|
| Amazon Web Services, Inc. | EC2 compute, RDS PostgreSQL, ElastiCache Redis, WAF | Application data at rest, request metadata, session cache, logs | ap-northeast-2 (Seoul) | Service Terms · DPA |
| Cloudflare, Inc. | CDN, DNS, TLS termination, DDoS protection, Pages hosting, R2 object storage (generated images, user files), Workers (image delivery via img.lunarabbit.ai) | IP addresses, request paths, timestamps, cached static assets, generated image files | Global edge network | DPA |
| RunPod, Inc. | GPU compute for self-hosted LLM inference (Qwen3.6-27B). User conversation text transits GPU memory for model inference; no data is stored by RunPod. | Conversation text (transit only, not stored) | United States (Secure Cloud) | Terms · Privacy |
| E2B, Inc. | Secure code execution sandbox (Office Builder mode — runs user-submitted code snippets in an isolated environment) | Code snippets (no PII) | United States | Terms of Service · DPA available on request |
| Qdrant Solutions GmbH (Qdrant Cloud) | Vector database for fewshot retrieval — stores de-identified embeddings only, never raw text | Embedding vectors (de-identified) | Frankfurt (EU) | Privacy |
| Google LLC | Google Accounts identity provider for Single Sign-On | Email, display name, profile picture at sign-in | United States (multi-region) | Privacy · DPA |
| Microsoft Corporation | Azure AD identity provider for Single Sign-On; Microsoft Graph API for user profile retrieval; Office.js host for Office Add-in surface | Email, display name, tenant ID, profile picture URL at sign-in | United States (multi-region) | DPA |
| Resend, Inc. | Transactional email delivery (account verification, team invitations, security notifications) | Email address, email subject and body | United States | Privacy · DPA |
5. Payment Processors
Payment processors are engaged when paid subscriptions are active. The following processors handle subscription billing, tax compliance, and payment processing.
| Sub-Processor | Purpose | Data Categories | Region | DPA / Policy |
|---|---|---|---|---|
| Paddle.com Market Limited | Merchant of Record for global subscription billing; tax handling, payment method support (cards, KakaoPay, Naver Pay) | Name, email, billing address, payment method, transaction history | United Kingdom (with sub-processors in US/EU) | DPA |
6. Notification of New Sub-Processors
We will provide at least 30 days' advance notice on this page before adding a new sub-processor that materially changes the categories of data we share. Users who are subscribed to update notifications (via [email protected]) will also receive email notice. If you object to a new sub-processor, you may terminate your subscription before that sub-processor begins processing your data.
7. Internal Access
In addition to the sub-processors above, authorized LunaRabbit personnel access stored customer data only for limited operational purposes — debugging regressions, investigating user-submitted error reports, security incident response, and statutorily required disclosures. Access is gated by single sign-on, IP allowlist, and logged for audit. This human access is described further in Section 3.5 of the Privacy Policy.
8. Contact
For questions about our sub-processors or to request a copy of any DPA we cannot share publicly, contact [email protected].
Operator: LunaRabbit Inc., a Delaware corporation. Mailing address: 131 Continental Drive, Suite 305, Newark, DE 19713, United States.