Subprocessor List
This page identifies third parties MVPGROW INC. uses to process personal data in support of Kollate. A provider processes only the data relevant to the service it supplies.
Effective October 1, 2026
Current subprocessors
| Provider | Service and data | Primary processing location |
|---|---|---|
| Supabase Pte. Ltd. | Primary database, authentication, storage, server functions, and transactional authentication email. Account, workspace, Customer Content, connection, usage, and technical data. | Primary Customer database in EU Central 1 (Frankfurt, Germany); limited support and subprocessor access may occur globally. |
| Lovable Labs AB / Lovable Labs Incorporated, as applicable | Application hosting, deployment platform, operational analytics, and error diagnostics. App requests, device and technical data, and data needed to operate the deployed application. | European Union, United States, and other locations used by its authorized subprocessors. |
| Cloudflare, Inc. | Content delivery, DNS, traffic routing, bot management, security, and request proxying. IP address, request headers, device, network, and security data; transient request content where routed. | Global edge network; United States and other locations. |
| OpenAI OpCo, LLC | Optional AI analysis invoked by an authorized user. Selected, redacted conversation text and relevant context. Standard API abuse-monitoring retention may be up to 30 days; API data is not used for model training by default. | United States and other locations used by authorized subprocessors. |
| Stripe, LLC and applicable Stripe affiliates | Subscription billing, payment processing, fraud prevention, and tax or financial compliance. Billing contact, transaction, device, and payment data; Kollate does not receive full card details. | United States, European Union, and other locations depending on the payer and payment method. |
| Vercel Inc. | Hosting and content delivery for the kollate.ai marketing website. IP address, request, device, and diagnostic data. | Global edge network; United States and other locations. |
| Google LLC and applicable Google affiliates | Google Analytics for consented website measurement. Online identifiers, approximate location, device, page-view, and interaction data. Advertising personalization and Google Signals are disabled in Kollate's configuration. | United States, European Union, and other locations used by Google. |
Optional and user-directed services
Google and GitHub may also act as independent providers when a user chooses their OAuth sign-in service. Their own terms and privacy notices govern that direct relationship. A customer may connect other third-party services; those providers are not MVPGROW subprocessors when they process data independently at the customer's direction.
Changes and objections
We may update this list as providers change. Where the DPA applies, we will provide reasonable advance notice before a new Subprocessor begins processing Customer Personal Data by emailing the registered workspace administrator or updating this public list. There is no fixed notice period. Customers may object promptly on legitimate data-protection grounds by contacting dpa@mvpgrow.com. The resolution process in Section 11 of the DPA applies.
Contact
Contact us for additional diligence information or questions about a listed provider.
MVPGROW INC.
16192 Coastal Hwy, Lewes, DE 19958, United States
Legal: legal@mvpgrow.com
Privacy and DPA: dpa@mvpgrow.com
Security: security@mvpgrow.com
Product support: support@kollate.ai