Subprocessors
Every third party that can touch customer data in Qua, what it receives, and where it processes it. This list is referenced by our Data Processing Agreement and kept in step with the product.
1. About this list
A subprocessor is a third party engaged by Qua that may process personal data contained in customer content. This page is the authoritative, current list referenced by our Data Processing Agreement and satisfies our transparency obligations under Article 28(2) of the GDPR and the equivalent provisions of the UK GDPR, the CCPA/CPRA and India's DPDP Act.
It mirrors the data-flow documentation we maintain internally: every provider that can receive customer content is listed here, together with what it receives and where it processes it. When we add a provider to the product, this page is updated in the same change. Last updated August 25, 2026.
2. Infrastructure and platform
These processors host the Qua application and its primary data stores. They are required to deliver the service and cannot be disabled per customer.
| Subprocessor | Purpose | Data it can receive | Processing location |
|---|---|---|---|
| Lovable Labs Incorporated (Lovable Cloud) | Application hosting, build and deploy pipeline, managed backend orchestration | Account data, session metadata, application logs | United States |
| Supabase Inc. (managed through Lovable Cloud) | Primary database, authentication, file storage, vector index | Account and organization records, session and message content, uploaded knowledge sources and their embeddings, audit ledgers | Australia (AWS ap-southeast-2) |
| Amazon Web Services, Inc. | Underlying compute and storage for the managed database region | All data at rest for the managed database | Australia (ap-southeast-2) |
| Cloudflare, Inc. | Edge delivery, TLS termination, DDoS protection, bot mitigation (Turnstile on public demo forms) | IP address, request metadata, challenge tokens | Global edge network |
3. Model providers — United States
Prompt content, selected knowledge excerpts and conversation history are sent to the model chosen for a turn. Qua does not use customer content to train models, and contracts with these providers prohibit training on API inputs by default.
| Subprocessor | Purpose | Data it can receive | Processing location |
|---|---|---|---|
| Lovable AI Gateway | Routing layer in front of Google and OpenAI hosted models | Prompt and completion content, token counts | United States |
| Google LLC (Gemini models) | Model inference, grounded answering, embeddings | Prompt and completion content, selected source excerpts | United States |
| OpenAI, L.L.C. | Model inference and image generation | Prompt and completion content, image prompts | United States |
| Anthropic PBC | Model inference (Claude family) | Prompt and completion content | United States |
| Groq, Inc. Open Models tier — only when a user explicitly selects one of these models | Serving of open-weight models | Prompt and completion content | United States |
4. Model providers — outside the US and EU
These models are never selected automatically. They sit in the Open Models tier and are reached only when a user explicitly names one, and an organization administrator can switch the tier off entirely. Data sent to them may be processed in mainland China or Singapore, outside the EEA, the UK and the United States.
| Subprocessor | Purpose | Data it can receive | Processing location |
|---|---|---|---|
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd. Off by default at organization level; explicit user selection required | Model inference (DeepSeek Chat / Reasoner) | Prompt and completion content | China |
| Alibaba Cloud (Qwen) Off by default at organization level; explicit user selection required | Model inference (Qwen family) | Prompt and completion content | China / Singapore |
| Moonshot AI (Kimi) Off by default at organization level; explicit user selection required | Model inference (Kimi family) | Prompt and completion content | China |
Never automatic. These providers sit in the Open Models tier. Qua's resolver never selects them; a user must name the model, and an organization administrator can disable the tier for the whole organization. Data sent to them may be processed in mainland China, outside the EEA, the UK and the United States, where no adequacy decision applies. Organizations with cross-border restrictions should disable the tier.
5. Retrieval, media and communications
These processors are engaged only for specific features. If the feature is not used, no data reaches the processor.
| Subprocessor | Purpose | Data it can receive | Processing location |
|---|---|---|---|
| Firecrawl (Sideguide Technologies, Inc.) Only when web research is enabled for a session | Web search and page retrieval for research sessions | Search queries derived from the prompt | United States |
| Exa Labs, Inc. Only when web research is enabled and routed to this provider | Secondary web search provider | Search queries derived from the prompt | United States |
| ElevenLabs Inc. Only when audio narration is generated | Text-to-speech narration for tutorials and audio overviews | Narration script text | United States |
6. Contractual safeguards
- Every subprocessor is engaged under a written contract with data protection terms no less protective than our own.
- Model providers are contracted on API terms that prohibit training on inputs.
- Transfers out of the EEA and the UK rely on Standard Contractual Clauses and the UK Addendum, supported by a transfer impact assessment, unless an adequacy decision applies.
- We assess each provider's security posture before onboarding and review it periodically.
- We remain liable to our customers for the acts and omissions of our subprocessors.
7. Change notifications and objections
Customers may subscribe to subprocessor change notices by emailing privacy@qua.dev with the subject "Subprocessor notifications". We give at least 30 days' notice before a new subprocessor begins processing customer personal data.
A customer may object on reasonable data-protection grounds within that period. We will work in good faith to offer a configuration that avoids the provider — for most optional providers this is a toggle in the admin console. If no reasonable alternative exists, the customer may terminate the affected subscription and receive a pro-rata refund of prepaid, unused fees.
8. Contact
Questions about this list, or a request for the underlying data-flow documentation: privacy@qua.dev. Data protection contact: dpo@qua.dev. See also the Data Processing Agreement and the Privacy Policy.