Who processes client data, what each can reach, and our 30-day change notice.
Public disclosure · Effective July 31, 2026 · Seven subprocessors, all United States based.
This list is referenced by Section 4 of our Data Processing Agreement and Section 6 of our Privacy Policy.
Luminary Impact uses a small set of infrastructure providers (“subprocessors”) to deliver the service. This page lists every subprocessor that may process client data, what each does, and what each can reach. We update it whenever it changes and give clients at least thirty (30) days’ written notice before adding a subprocessor that will process client data, with a right to object (see the Data Processing Agreement, Section 4).
| Subprocessor | Function | Data it may process | Location |
|---|---|---|---|
| Anthropic | AI drafting via API | Coded briefs and organizational content submitted for drafting. Never participant identities, because the vault is not readable by AI systems. Under the vendor’s commercial API terms, inputs and outputs are not used to train models. | United States |
| Supabase | Database, authentication, file storage | All platform data, encrypted at rest. The participant identity vault lives here under database level access control readable only by the client’s own users. | United States |
| Vercel | Application hosting for the client and operations portals | Data in transit through the application, encrypted using TLS. | United States |
| Netlify | Marketing website hosting | Website visit data and form submissions on the public site only. No platform client data. | United States |
| Stripe | Payments and billing | Billing contact details, payment method, and invoice history. Card numbers are held by Stripe and never by Luminary Impact. | United States |
| Resend | Transactional email delivery | Recipient name and email address, and the content of transactional messages such as support ticket notifications, signature confirmations, executed agreement copies, and account and billing notices. | United States |
| Twilio | SMS messaging | Phone numbers and the content of SMS messages, including one time passcodes sent for account verification. Voice calling is available through this provider but is not in use at this time. | United States |
Agreements are signed natively inside our own platform. No third party electronic signature provider processes client agreements or signature data, so there is no e-signature subprocessor on this list. Executed agreements are sealed with a content hash and a certificate of completion recording the signer, the timestamp, the identity verification method, and the electronic records consent.
All access to client data is by Luminary Impact’s own personnel, under written confidentiality agreements signed before any access is granted, scoped by assignment, and recorded. No data broker, advertiser, or analytics reseller receives client data. We do not sell data, we do not run advertising, and we do not share client data for marketing.
We will post updates to this list and notify clients directly of any addition that touches client data at least thirty (30) days in advance. Questions: support@lilxhub.com.
Legacy X LLC · d/b/a Luminary Impact · East Stroudsburg, Pennsylvania.