StarboardLog Subprocessor and Service Provider Information

This document separates providers engaged for Customer Workspace processing from their onward providers, a Customer-selected Google connection and independent billing recipients. Their roles and principal locations are set out below.

1 Operator and classifications

Operator: Sándor Levente Szabó e.v., 9400 Sopron, Semmelweis utca 10., Hungary; individual entrepreneur registration number 61070435; Hungarian tax number 91404451-1-28; EU VAT number HU91404451. Contact for privacy questions or Subprocessor objections: starboardlog@gmail.com. Direct Subprocessors engaged to handle Customer Workspace Personal Data are distinguished from their onward providers, Customer-directed Google services and providers used only for our own controller-side billing. The DPA governs direct Subprocessor authorization and objections.

2 Direct Subprocessors

Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, United States, supplies managed application hosting, database, authentication, server functions, security and error reporting. It may handle Workspace data, account identifiers, logs and limited support context. Primary application data is in Ireland; Lovable and its authorized onward providers may process limited data elsewhere under its DPA and applicable transfer safeguards.

Plus Five Five, Inc. operating Resend, 2261 Market St #5039, San Francisco, CA 94114, United States, provides transactional authentication, invitation and service email. It processes recipient email, supplied name, message content and delivery metadata. Its DPA and applicable Standard Contractual Clauses or other lawful transfer mechanism govern non-EEA processing. No newsletter or advertising role is described.

3 Managed onward providers

Lovable manages onward infrastructure including Supabase-based database and authentication components; Resend manages its own onward email chain. Their current official provider lists govern those chains. These onward providers are not separate direct StarboardLog contracts unless separately engaged.

4 Customer-directed Google services

Google Drive, supplied by Google LLC or its applicable contracting entity, is an optional Customer-directed integration. The Customer or User chooses and authorizes the account and specific vessel files. StarboardLog requests drive.file, stores protected connection data, metadata and file references, and facilitates the selected-file workflow. Underlying file bytes remain in the connected Google Drive; Guests have no Drive access. Google operates under the relevant Customer/User relationship and applicable Google API terms. StarboardLog follows Google API Services User Data Policy Limited Use requirements.

5 Controller-side providers

KBOSS.hu Kft. operating Számlázz.hu is used outside the application for the Provider’s manual invoices and may handle billing identity, address, tax or VAT details, invoice content and administration. This is a controller-side service provider for the Provider’s invoicing, not a Workspace Subprocessor for that use. Advisers, insurers and authorities may receive limited information as lawfully necessary.

6 Change notice and objection

For an intended new or replacement direct Subprocessor, we record provider, service, data categories, location and safeguards. Where reasonably practicable, we update this information and email affected Customer Admins at least 30 calendar days before processing starts. Customers may object within that period at starboardlog@gmail.com on reasonable data-protection grounds. We will assess proportionate alternatives, safeguards or termination of the affected feature or Subscription under the Agreement. Urgent security, legal or continuity changes may require implementation first and notice as soon as practicable. Material onward-provider changes are reviewed and notified when feasible and significant.

7 Version and changes

Version 1.0. Effective Date: 26 September 2026. Updates to the direct Subprocessor list follow Section 6 and DPA Section 10.