Subprocessors
Last updated 21 September 2026
When an agency uses Lyra for its clients, we process their data on the agency's behalf. These are the providers we rely on to do that, what each one handles, and where.
Current subprocessors
| Provider | What for | Data | Where | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Servers for the application, its database and its cache | Everything Lyra holds | Germany | Within the EU |
| Cloudflare, Inc. | Storage of uploaded media (R2, EU jurisdiction) | Media the agency uploads | European Union | Stored within the EU |
| Cloudflare, Inc. | DNS, TLS and the network in front of the site, app and API | Traffic in transit, including IP addresses | Global network; United States company | EU-US Data Privacy Framework; standard contractual clauses |
| Google LLC (Google Workspace) | Our email: invitations, notifications and support | Email addresses and message content | United States and EU | EU-US Data Privacy Framework; standard contractual clauses |
We also reach the data from Israel, where the partnership operates. The European Commission recognises Israel as providing an adequate level of data protection, so no further safeguard is required for that.
Chosen by the agency, not by us
- Anthropic or OpenAI, only if a workspace turns on AI-assisted auto replies. The agency picks the provider and supplies its own API key, so the provider acts under the agency's own agreement with it. Only the single incoming message being judged is sent. Off by default.
- Webhook endpoints an agency registers receive the events it subscribes to, at the address it chooses.
Other services a visitor's browser contacts
- OpenStreetMap Foundation (United Kingdom): map images and place search in the campaign builder's targeting map. The map images are loaded by the browser, so OpenStreetMap sees the viewer's IP address; place names are looked up by our server. The UK has an EU adequacy decision.
The platforms are not subprocessors
Instagram, Facebook and Meta Ads (Meta Platforms), TikTok, YouTube and Google Ads (Google) receive data because the agency tells Lyra to publish, answer or advertise there. They act as independent controllers under their own terms and privacy policies, not on our instructions, so they are not on the list above.
Changes to this list
We will update this page and email workspace owners at least 30 days before a new subprocessor starts handling personal data. An agency may object on reasonable data protection grounds within 15 days, as set out in our data processing agreement.
Questions: [email protected].