Infrastructure Providers and Subprocessors

1. Scope and reported providers

This inventory concerns Lumez, offered by Digital Directive at lumez.digital-directive.com, with initial markets in South America. Digital Directive reports using Amazon Web Services (AWS), Google Cloud and Vercel, together with infrastructure that it operates itself. The entries below distinguish those providers from software components and customer-selected recipients.

The provider names are confirmed by Digital Directive. The specific services, contracting legal entities, allocation of data, processing and backup locations, and applicable contractual instruments have not been confirmed for each entry. Identifying a provider does not mean that every category of Lumez data is sent to it, that every service it offers is used, or that a particular processing agreement has been accepted.

2. Roles depend on the processing activity

When Digital Directive processes workspace information on a business customer’s instructions, a supplier engaged by Digital Directive to perform part of that processing may be a subprocessor. The same company may have a different role for another activity. The assessment must follow the actual decisions, instructions and contract, rather than a general label applied to every service.

• Providers used for Digital Directive’s own account administration, business contacts or legal obligations may be processors of Digital Directive or independent controllers, depending on the activity. Their disclosures also belong in the Privacy Policy.
• A recipient selected and contracted directly by the customer is not automatically a Digital Directive subprocessor. Customer-managed integrations require their own assessment of responsibility and instructions.

3. Software components and the local environment

The reviewed local configuration uses the components below. Installing or running software does not by itself demonstrate that its publisher receives personal data or provides a hosted service to Lumez. Software components and the companies contracted to operate their infrastructure are separate entries in a processing inventory.

• PostgreSQL: database software for application records. Its presence does not identify a contracted database hosting provider.
• Redis: software used by the processing and queue infrastructure. Its presence does not establish a managed cloud service contract.
• MinIO: local object storage compatible with the S3 interface. That compatibility does not identify the services used from AWS or establish the country in which production data is stored.
• Mailpit and Better Auth: respectively, a local email-testing tool and the authentication library used by the application. They do not establish a production email-delivery provider or an external hosted identity provider.

4. Reported providers and own infrastructure

The following names are the infrastructure providers reported by Digital Directive. The role and scope of access of each provider depend on the actual service and contract. Their inclusion here does not establish that each one processes message content, credentials or every other data category.

• Amazon Web Services (AWS): reported cloud provider. The AWS services used, contracting legal entity, relevant data categories and production or backup regions have not been confirmed in this inventory.
• Google Cloud: reported cloud provider. The services used, contracting legal entity, relevant data categories and processing locations have not been confirmed in this inventory. This entry does not establish use of Google AI models.
• Vercel: reported provider used in Lumez operations. The specific services, contracting legal entity, relevant data categories and processing locations have not been confirmed in this inventory.
• Own infrastructure: operated by Digital Directive and therefore not a separate third-party subprocessor. Any external provider involved in that infrastructure must be assessed separately for its actual access and role; the location and scope of the own infrastructure have not been confirmed here.

5. Service-level processing details

For each provider, the processing record must identify the information below for the services actually used. This mapping includes any hosting, databases, storage, backups, email, monitoring, support or billing that receives or can access personal data; listing a category does not establish that a particular provider supplies it.

• Legal entity and service name; the party that contracts the service; whether the relationship is as processor, subprocessor or independent controller; and the purposes actually authorized.
• Relevant categories of data and data subjects; access to content, metadata or credentials; countries of storage, backup and support access; and retention or deletion arrangements.
• Applicable processing agreement, security commitments and transfer mechanism; whether use is mandatory or depends on a customer-enabled feature; and the date on which the entry was verified.

6. Meta and WhatsApp integration

Lumez includes an integration with the WhatsApp Business Platform and Meta APIs. When a real connection is used, operation can involve business and account identifiers, telephone numbers, channel credentials, message content and media, delivery information, and webhook events, according to the enabled functions. A local simulation does not establish that these data were transmitted to Meta.

Meta/WhatsApp is identified here as an integration. The applicable contracting entity and legal role depend on the actual connection model and processing activity. The relevant entity, contracts accepted by Digital Directive and by the customer, and responsibilities for each category must be identified from that relationship. Business messaging and processing terms must be considered together; an independent-controller activity must not be presented as subprocessing.

7. Artificial intelligence features

The reviewed AI-agent functionality currently allows publication only with its local simulated runtime. It does not establish transmission to an external model provider. The reported use of Google Cloud infrastructure does not mean that a Google AI service is enabled, and product labels or installed libraries do not establish engagement of any other external model provider.

Before activating an external AI provider, the inventory and contractual assessment must specify the data sent, purposes, retention, access by personnel, use or non-use for training, processing locations and customer controls. Neither a general no-training guarantee nor permission to train on conversations can be inferred from the present simulator.

8. Destinations configured by the customer

Automations can send data to an HTTPS webhook selected by the customer. The destination and the information included in the action must be assessed before the automation is enabled. Technical acceptance of a URL does not verify the recipient’s contract, privacy practices or international-transfer safeguards.

Where the customer directly chooses and contracts that destination, its operator does not automatically become a Digital Directive subprocessor. The customer’s instructions and the respective responsibilities must be documented, including what data may be sent and how access or future transmissions can be stopped. If Digital Directive itself engages the destination to deliver its service, that arrangement must instead be assessed for inclusion in its own supplier inventory.

9. Countries and international transfers

A supplier’s headquarters, a software brand, the official domain or the initial markets in South America do not determine where personal data is processed. Storage, replicas, backups and remote support access must be mapped separately. The regions used by AWS, Google Cloud, Vercel and the own infrastructure are not specified here; this inventory does not establish an exclusive data-residency commitment.

For transfers subject to the Brazilian LGPD, the actual flow must rely on an applicable legal mechanism and meet the transparency requirements. ANPD standard contractual clauses, when used, must follow the official text and conditions; this document neither reproduces those clauses nor claims that they have already been signed.

Where the GDPR or UK rules apply, transfers require a separate assessment under those rules. The 2026 adequacy decisions between Brazil and the European Union can be relevant within their scope, but do not automatically cover onward transfers or establish UK adequacy. California obligations, including any service-provider or contractor restrictions, also depend on legal applicability and the actual relationship. Providing translations does not by itself determine which of these regimes applies.

10. Approval, changes and customer requests

The assessment of a subprocessor must address the necessity and scope of access, confidentiality, security measures, assistance with rights and incidents, retention and deletion, and further delegation. Applicable contracts must establish instructions and responsibilities consistent with the role. This inventory does not certify a supplier, a completed audit or a service-level commitment.

Relevant additions or replacements must be handled under the applicable processing agreement and legal requirements, including any customer authorization or objection rights. The particular notice period and notification method must be established in the relevant relationship; this document does not state that an automated subscription mechanism exists.

Privacy, support and provider-related requests may be sent to arthurgfcardozo@gmail.com or to Digital Directive at the postal address identified in these documents. Identify the relevant workspace and service without sending access tokens or unnecessary conversation content. Data-subject requests follow the Privacy Policy and the Rights and Deletion document, including the existing authenticated controls. Removing an integration does not by itself prove deletion of every copy held by its recipients.