Subprocessor Registry
Subprocessor Registry
Last updated: 2026-07-15 Version: 1 Applies to: all LighChat clients (web, desktop, mobile).
⚠️ Draft. Requires legal review and placeholder completion before publication.
To provide the service, [LEGAL ENTITY NAME] (the "Operator") engages providers (subprocessors) that act on its behalf under agreements ensuring a level of data protection no lower than required by applicable law (Art. 28 GDPR; Art. 6(3) of Russian Federal Law 152-FZ). Below is the list current as of the version date. Some operations are performed on servers outside the Russian Federation — see the Privacy Policy and the Consent to Personal Data Processing (cross-border transfer section).
Legend: client-direct — the request is made directly from the user's device (the provider is exposed to the user's IP address); backend — the request is made by the Operator's server (the user's IP is not exposed to the provider).
1. Cloud infrastructure and platform
| Subprocessor | Jurisdiction | Data categories | Purpose |
|---|---|---|---|
| Google LLC (Firebase Authentication) | USA | email, phone, password hash, user identifier, OAuth profile, session tokens, IP | Registration, authentication, session management |
| Google LLC (Cloud Firestore, Realtime Database) | USA (realtime DB — EU region) | account data, messages, chat metadata, presence, settings, IP | Primary storage and low-latency layer |
| Google LLC (Cloud Storage for Firebase) | USA | media (photos, video, voice, documents), avatars | Storage of user content |
| Google LLC (Cloud Functions) | USA | data passed to server calls | Server-side logic |
| Google LLC (Firebase Cloud Messaging) | USA | push tokens, user identifier, notification body | Push notification delivery (web, Android) |
| Google LLC (Firebase App Check / reCAPTCHA Enterprise) | USA | IP, browser fingerprint, attestation token | Protection against automated abuse |
| Google LLC (Firebase Remote Config, App Hosting, Cloud Build) | USA | app-instance-id, IP, web requests | Feature configuration, web hosting, builds |
2. Analytics and diagnostics (only with separate consent)
| Subprocessor | Jurisdiction | Data categories | Purpose |
|---|---|---|---|
| Google LLC (Google Analytics / GA4, BigQuery) | USA | usage events, pseudonymized identifier (hash), IP, device type | Product analytics in aggregated form |
| Google LLC (Firebase Crashlytics) | USA | crash stacks, device model, OS version, IP | Mobile app crash diagnostics |
| Google LLC (Looker Studio) | USA | aggregated metrics (non-identifying) | Internal analytics dashboards |
The user identifier is pseudonymized (hashed) before being sent to analytics services; the raw identifier is not transmitted to them.
3. Communications: phone verification and email
| Subprocessor | Jurisdiction | Data categories | Purpose | Method |
|---|---|---|---|---|
| Telegram (Telegram Gateway) | UAE / UK | phone number, verification code | Phone verification (primary channel) | backend |
| Resend Inc. | USA | email, message body (codes, service notices) | Transactional email | backend |
| Apple Inc. (APNs) | USA | VoIP push tokens, user identifier | Call push notifications on iOS | backend |
4. Media and content
| Subprocessor | Jurisdiction | Data categories | Purpose | Method |
|---|---|---|---|---|
| Giphy Inc. (Meta) | USA | search query text | GIF/sticker search | backend (via Operator's proxy) |
| Translated Srl (MyMemory) | Italy / EU | search query text | Query translation for GIF search | backend (via Operator's proxy) |
| Song lyrics provider (LRCLIB) | EU | track artist and title | Displaying song lyrics | client-direct |
| CDN (jsDelivr, unpkg) | global | IP (loading libraries/models) | Delivery of client resources (maps, video processing) | client-direct |
| Apple Inc. (Apple Maps), YouTube (Google LLC) | USA | address/coordinates (deep-link), IP (embed) | Opening maps, link previews | client-direct |
5. Voice and video calls (WebRTC)
| Subprocessor | Jurisdiction | Data categories | Purpose | Method |
|---|---|---|---|---|
| Media server (self-hosted LiveKit on a rented VPS) | Netherlands | audio/video of group meetings, IP, access token | Group meeting transport (SFU) | client-direct |
| Metered Inc. (TURN) | Canada | relayed call media stream, IPs of parties | Relay when direct connection is impossible | client-direct |
| Google LLC (STUN) | USA | IP (ICE network path discovery) | Establishing a direct connection | client-direct |
6. App stores and distribution
Apple App Store (Apple Inc., USA), Google Play (Google LLC, USA), and direct download of the desktop version — distribution of the app and updates.
7. Other recipients as required by law
Data may be disclosed to authorized government authorities in the cases and manner provided by applicable law, and, upon reorganization of the Operator, to its legal successor while preserving processing terms.
Appendix. Russian-contour subprocessors
For a future version of the Service intended for users in the Russian Federation, the set of subprocessors will differ: infrastructure and primary data recording will be located within the Russian Federation; phone verification and other operations will use Russian providers (including SMS/flash-call providers and Russian sign-in services). In the current (global) version of the Service these providers are not used. The list for the Russian contour will be published as a separate appendix upon its launch.
*The Operator reserves the right to engage new subprocessors, notifying of changes by updating this document. Material changes are communicated to users as provided by the Privacy Policy.*