Leam HQ
Sub-processors
Designed with POPIA principles in mind. Operational privacy workflows are in place — PDF-only data exports, data subject access / correction / deletion / objection handling, account and workspace deletion workflows, audit-logged actions, and strict separation between user workspaces and Leam HQ internal operations.
This document describes how Leam HQ, a product of Digital Culture Innovations (Pty) Ltd (Registration 2026/173422/07, Kimberley, South Africa), handles your data under the Protection of Personal Information Act, 2013. Questions: legal@leamhq.co.za.
Leam HQ relies on the following sub-processors to operate. We update this list when our infrastructure changes.
| Provider | Purpose | Data processed | Region | Privacy policy |
|---|---|---|---|---|
| Supabase | Authentication, Postgres database, file storage, workspace data and app infrastructure | All Leam HQ data (accounts, workspaces, business records, OAuth tokens, audit logs) | EU / Ireland | supabase.com/privacy |
| Render | Application hosting, server runtime and deployment infrastructure | Request metadata, server logs, application traffic | Frankfurt, Germany | render.com/privacy |
| Anthropic | AI agent and business intelligence (Claude models) | Prompts you send to the agent plus the workspace context required to answer them | United States | anthropic.com/legal/privacy |
| Resend | Transactional email delivery (invoices, confirmations, automations) | Recipient email address, message content | United States | resend.com/legal/privacy-policy |
| PayFast | Subscription payment processing | Subscription identifier, billing amount; cardholder data handled by PayFast directly | South Africa | payfast.io/privacy-policy |
| Google APIs | Gmail, Calendar, Drive integrations you choose to connect | OAuth tokens, account email, data you actively sync | United States (Google global) | policies.google.com/privacy |
| Microsoft Graph | Outlook calendar integration you choose to connect | OAuth tokens, account email, calendar events you actively sync | United States / EU (Microsoft global) | privacy.microsoft.com |
| Google Fonts | Web fonts (Inter) | Visitor IP address per request | Google global | policies.google.com/privacy |
| unpkg / jsDelivr | Public CDN for React and Supabase JS | Visitor IP address per request | Cloudflare global | cloudflare.com/privacypolicy |
| Sentry (optional) | Error monitoring — only active if Leam HQ has SENTRY_DSN configured | Error stack traces; PII scrubbed where practical | United States / EU | sentry.io/privacy |
Cross-border transfers
Leam HQ is operated from South Africa, but Supabase infrastructure for this project is hosted in the EU / Ireland region, and our application hosting on Render is located in Frankfurt, Germany. This means some personal information, workspace data, request metadata and application traffic may be stored or processed outside South Africa.
Digital Culture Innovations (Pty) Ltd uses vetted infrastructure providers and relies on appropriate contractual, technical and organisational safeguards for cross-border processing. You consent to these transfers as required for the service to function.
Changes
We update this list when we add, remove or materially change a sub-processor. You can subscribe to updates by emailing legal@leamhq.co.za with the subject "Sub-processor updates".