Sub-processors
Last updated: 13 October 2026
Vanray uses the service providers below to run LangoHub. Each one processes personal data only to provide its service to us, under a written agreement that includes data-protection terms.
Notice of changes. Estate customers get at least 30 days' notice, by email and in the app, before a new sub-processor starts processing Estate Data. See clause 5 of our Data Processing Agreement.
Sub-processors that handle Estate Data
| Provider | What they do for LangoHub | Personal data involved | Where | Safeguards |
|---|---|---|---|---|
| Lovable Labs Inc. (Lovable Cloud), using Supabase on Amazon Web Services | Hosting of the app, database, sign-in and private photo storage, scheduled jobs | All Estate Data and account data | United States (AWS Oregon, us-west-2) | Data processing agreements with standard contractual clauses; SOC 2 Type II and ISO 27001 certified providers; encryption in transit and at rest |
| OpenAI, through the Lovable AI gateway | Reading the name and document number from an ID photo, only when an estate turns on ID scanning | ID image (not stored by LangoHub; the provider may keep it up to 30 days for abuse monitoring); extracted name and number | United States | Provider terms: no training on API data; Lovable DPA |
| Anthropic, through the Lovable AI gateway | Turning a resident's short typed note into visitor form fields | The note text, such as a guest name, time or number plate | United States | Provider terms: no training on API data; nothing is saved until the resident confirms; Lovable DPA |
| WhatsApp LLC (Meta), WhatsApp Business Platform (Cloud API) | Sending visitor-arrival alerts to residents who opted in | Resident phone number; estate name; visitor name; unit; arrival time; delivery status | United States | WhatsApp Business Data Processing Terms and data transfer addendum; messages kept by the provider for up to 30 days |
| Africa's Talking Ltd | Sending SMS (delivery notices, account and billing reminders) | Phone number; message text; delivery status | Kenya (company) | Provider terms with data-protection undertakings |
Providers used for our own business (not Estate Data)
| Provider | Purpose | Data | Where |
|---|---|---|---|
| Stadia Maps, Inc. | Map tiles and address lookup on the internal sales map | Business addresses of estates; viewer IP address | United States |
| OpenStreetMap Foundation (Nominatim) | Fallback address lookup for the internal sales map | Business addresses only | United Kingdom / European Union |
| GitHub (Microsoft) | Source code and Android app builds | No personal data of estates or visitors | United States |
Independent providers (not our sub-processors)
These providers act under their own licences and privacy policies when you use them:
- Safaricom PLC (M-Pesa): payment of LangoHub invoices and, where an estate enables it, service-charge payments to the estate.
- Licensed payment service providers: card and mobile-money payments. They are listed in the app when enabled.
- Google (Google Play): if you download the app from Google Play.
Questions? Email privacy@langohub.app.