Subprocessor Registry
Subprocessor Registry
Last updated: 2026-08-03 Version: 2 Applies to: all LighChat clients (web, mobile, desktop).
To operate the Service, KDS Consulting Inc (the "Controller") engages providers ("subprocessors") that process personal data on our instructions under agreements providing protection no lower than applicable law requires (GDPR Art. 28, with Standard Contractual Clauses where personal data leaves the EEA or the UK). This list is current as of the version date.
Legend: client-direct — the request goes from your device to the provider (so the provider sees your IP address); backend — the request is made by our servers (the provider does not see your IP).
1. Cloud infrastructure and platform
| Subprocessor | Location | Data categories | Purpose |
|---|---|---|---|
| Google LLC (Firebase Authentication) | USA | email, phone, password hash, user identifier, OAuth profile, session tokens, IP | Registration, authentication, sessions |
| Google LLC (Cloud Firestore, Realtime Database) | USA (Realtime Database — EU region) | account data, messages, chat metadata, presence, settings, IP | Primary storage and low-latency layer |
| Google LLC (Cloud Storage for Firebase) | USA | media (photos, video, voice, documents), avatars | User content storage |
| Google LLC (Cloud Functions) | USA | data passed to server calls | Server-side logic |
| Google LLC (Firebase Cloud Messaging) | USA | push tokens, user identifier, notification body | Push delivery (web, Android) |
| Google LLC (Firebase App Check, reCAPTCHA Enterprise) | USA | IP, browser signals, attestation token | Protection against automated abuse |
| Google LLC (Firebase Remote Config, App Hosting, Cloud Build) | USA | app instance id, IP, web requests | Feature configuration, web hosting, builds |
2. Analytics and diagnostics (only with consent)
| Subprocessor | Location | Data categories | Purpose |
|---|---|---|---|
| Google LLC (Google Analytics 4, BigQuery) | USA | usage events, pseudonymised identifier (hash), IP, device type | Aggregated product analytics |
| Google LLC (Firebase Crashlytics) | USA | crash stacks, device model, OS version, IP | Crash diagnostics |
| Google LLC (Looker Studio) | USA | aggregated, non-identifying metrics | Internal dashboards |
The user identifier is hashed before it reaches analytics; message content is never sent.
3. Communications: verification codes and email
| Subprocessor | Location | Data categories | Purpose | Method |
|---|---|---|---|---|
| Telegram (Telegram Gateway) | UAE / UK | phone number, verification code | Phone verification (where enabled) | backend |
| Telegram (Login Widget) | UAE / UK | Telegram user id, name, username, profile photo, IP | Sign-in with Telegram | client-direct |
| Resend Inc. | USA | email address, message body (codes, service notices) | Transactional email | backend |
| Apple Inc. (APNs) | USA | push and VoIP tokens, user identifier | iOS notifications and call wake-ups | backend |
4. Media and content features
| Subprocessor | Location | Data categories | Purpose | Method |
|---|---|---|---|---|
| Giphy Inc. (Meta) | USA | search query text | GIF and sticker search | backend (via our proxy) |
| Translated Srl (MyMemory) | Italy / EU | search query text | Translating GIF search queries | backend (via our proxy) |
| LRCLIB | EU | track artist and title | Song lyrics display | client-direct |
| jsDelivr, unpkg (CDN) | global | IP (loading libraries and models) | Delivery of client-side resources | client-direct |
| Apple Inc. (Apple Maps), YouTube (Google LLC) | USA | address/coordinates (deep link), IP (embed) | Opening maps, link previews | client-direct |
On-device processing (no subprocessor). Speech recognition for live captions (Apple Speech framework on iOS) and machine translation (Google ML Kit models downloaded to the device) run locally on your device. Audio and text are not sent to us or to a third party for these features. Model downloads themselves are served by Google and reveal only the fact of the download and your IP address.
5. Calls and meetings (WebRTC)
| Subprocessor | Location | Data categories | Purpose | Method |
|---|---|---|---|---|
| Media server (self-hosted LiveKit on a rented VPS) | Netherlands | group meeting audio/video, IP, access token | Group meeting transport (SFU) | client-direct |
| Metered Inc. (TURN) | Canada | relayed media stream, participants' IPs | Relay when a direct connection is impossible | client-direct |
| Google LLC (STUN) | USA | IP (ICE path discovery) | Establishing a direct connection | client-direct |
6. Distribution
Apple App Store (Apple Inc., USA), Google Play (Google LLC, USA) and direct download of the desktop applications — distribution and updates.
7. Other recipients
Data may be disclosed to competent authorities in the cases and manner provided by law (see the Law Enforcement Guidelines), and to a legal successor in the event of a merger, acquisition or reorganisation, on the same terms.
*We may engage new subprocessors, and we notify changes by updating this document; business customers receive at least 14 days' advance notice under the Data Processing Agreement. Questions: privacy@lighchat.online.*