Trust Center
Compliance·Last updated July 2026
Sub-Processor Register
A complete register of the third-party services that process data on behalf of Aletso VOF — what they do, what they process, and where.
- Operated by
- Aletso VOF
- Governing law
- The Netherlands
- Data stored in
- Frankfurt, Germany (European Union)
- Contact
- privacy@lensym.com
01How we choose sub-processors
When you use Lensym, your data may be processed by a small number of third-party sub-processors that provide our infrastructure. This register lists every one of them — there are exactly four.
Our commitments
- Every sub-processor operates under a GDPR-compliant Data Processing Agreement
- We keep the list deliberately short to reduce risk
- Personal data is stored in the EU; where a provider processes data outside the EEA, appropriate safeguards apply
- Survey response data is never shared with analytics or AI vendors
02Current sub-processors
Cloudflare
Application hosting, CDN, DDoS protection, bot protection
- Data processed
- IP addresses, request metadata, application traffic
- Location
- Global edge network; EU data processing safeguards
- Safeguards
- GDPR-compliant DPA · EU-US Data Privacy Framework
Neon
PostgreSQL database hosting (all platform data)
- Data processed
- Account data, survey content, survey responses
- Location
- Frankfurt, Germany (European Union)
- Safeguards
- GDPR-compliant DPA · EU data residency
Stripe
Payment processing and subscription billing
- Data processed
- Billing details, payment methods (tokenized), invoices
- Location
- EU customers served by Stripe Payments Europe (Ireland)
- Safeguards
- GDPR-compliant DPA · PCI DSS Level 1
Resend
Transactional email delivery (verification, receipts, alerts)
- Data processed
- Email addresses, email content, delivery logs
- Location
- United States
- Safeguards
- GDPR-compliant DPA · EU Standard Contractual Clauses
03When the list changes
Before we add or replace a sub-processor that handles personal data, we follow this process:
1
Advance notice by email to all customers, at least 30 days before the change2
This register is updated with the new provider and its safeguards3
You may object to the change during the notice period4
If we cannot accommodate your objection, you may terminate and export your data without penaltyQuestions about a specific provider? Contact privacy@lensym.com.