Lemo-Design

Server hosting in Germany (EU). Three servers:

• LemoDesign — customer data managed by us
• Development — in-progress client projects
• Production — live client software

Domain management and R2 object storage for customer-uploaded assets and encrypted server backups. Files are stored in Cloudflare R2, encrypted at rest (AES-256). Buckets are private by default; public only on customer request. Buckets are not restricted to the EU jurisdiction; transfers to the US are covered by Cloudflare's DPA and the EU Standard Contractual Clauses / EU-US Data Privacy Framework. Network logs, which can include IP addresses, are processed in Cloudflare's data centers in the US and Europe. EU-only processing is available as a paid add-on (Data Localization Suite), which we do not currently use.

Finances, invoicing and payment processing. Hosts customer data. Moneybird is a Dutch company; data is stored in the EU.

Payment processing for online payments. Stripe, Inc. is a US company (San Francisco); EU customers are served by Stripe Payments Europe in Ireland, and data may be processed in the US. US transfers are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.

Email. AgentMail, Inc. is US-based (San Francisco): US transfer.

AgentMail subprocessors (source: agentmail.to/legal/subprocessors, list dated 26 Jun 2026):

• AWS (US/EU) — infrastructure; where mail is stored
• Svix (US/EU) — webhooks
• Clerk (US) — auth
• Stripe (US) — billing
• PostHog (US/EU) — analytics
• Vercel (US) — hosting
• Google (US) — communication
• Slack (US) — communication
• Plain (US) — support

Change notifications: support@agentmail.cc.

Code hosting for our codebases only; no credentials or client data are stored there. GitHub, Inc. is based in the United States (San Francisco): US transfer. Under its Data Protection Agreement, transfers from the EU are covered by GitHub's certification under the EU-US Data Privacy Framework (active, including the UK and Swiss extensions) and by the EU Standard Contractual Clauses.

Password and secrets management. Stores our keys, passwords and other credentials with end-to-end encryption, so 1Password cannot read the stored data. Our 1Password account is hosted in the EU.

Our own in-house software, running on our own Hetzner server in Germany, so it is not an outside vendor. Holds custom session recording at customer login (metadata only). Breach notifications are filed here with attached resolution tasks.

Domain registration (Netherlands). Holds the registrant contact details (name, address, email, phone) required to register domains. Domains only; nothing is hosted at TransIP.

Domain management and Microsoft Office 365 services (email and office tools), resold through Hostnet (Netherlands). No websites are hosted at Hostnet. Office 365 data is processed by Microsoft under its own data processing terms.

Email services, hosted by DreamHost (California, US): US transfer. DreamHost acts as a data processor under its Customer Data Processing Addendum, which is part of its Terms of Service and includes the EU Standard Contractual Clauses (controller-to-processor module) for transfers outside the EEA.

Support conversations and messages. Chatwoot is self-hosted on our own Hetzner server in Germany, so support data stays on our infrastructure and is not shared with Chatwoot the company.

Customers can reach us through Facebook, Instagram, Messenger and WhatsApp, all Meta products. We manage these conversations in BacksterOS, where they are linked to the customer's profile and contact details.

Messages you send us on these platforms are also processed by Meta under its own terms and privacy policy, which can include transfers to the United States.

For WhatsApp we use a WhatsApp Business account on our company number, for client communication only. It is connected through our self-hosted Chatwoot to BacksterOS, where only Remon de Vries and our AI agents can read the messages, and the agents may reply on our behalf. If we delete a conversation, we can't control how long Meta keeps its copy, and copies may remain on the phones involved.

Customers can reach us through LinkedIn, which is owned by Microsoft. We manage these conversations in BacksterOS, where they are linked to the customer's profile and contact details.

Messages you send us on LinkedIn are also processed by LinkedIn under its own terms and privacy policy, which can include transfers to the United States.

Customers can reach us through X. We manage these conversations in BacksterOS, where they are linked to the customer's profile and contact details.

Messages you send us on X are also processed by X under its own terms and privacy policy, which can include transfers to the United States.

AI infrastructure for our AI agents. Cursor is provided by Anysphere, Inc. in San Francisco, a SpaceX subsidiary. Through Cursor, our agents use AI models from OpenAI, Anthropic, Google, SpaceXAI, Meta and other suppliers for programming and code development. Grok (SpaceX) handles agent support, email replies, client support and documentation, and is never used for development.

Data is processed mainly in the United States. Cursor uses the EU Standard Contractual Clauses for transfers. Cursor's own subprocessors are listed at trust.cursor.com/subprocessors.