Who processes client data, what each can reach, and our 30-day change notice.
Public disclosure · Effective July 14, 2026 · Offshore support is scoped away from client data — disclosed, not hidden.
Luminary Impact uses a small set of infrastructure providers (“subprocessors”) to deliver the service. This page lists every subprocessor that may process client data, what each does, and what each can reach. We update it whenever it changes and give clients at least thirty (30) days’ written notice before adding a subprocessor that will process client data, with a right to object (see the Data Processing Agreement, Section 4).
| Subprocessor | Function | Data it may process | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All platform data, encrypted at rest. The participant identity vault lives here under database-level access control readable only by the client’s own users. | United States |
| Vercel | Application hosting (client + operations portals) | Data in transit through the application, encrypted (TLS). | United States |
| Stripe | Payments and billing | Billing contact details, payment method, invoice history. Card numbers are held by Stripe, never by Luminary Impact. | United States |
| Resend | Transactional & notification email | Email addresses and the content of service notifications sent to client users. No participant identities. | United States |
| Anthropic | AI drafting via API | Coded briefs and organizational content submitted for drafting. Never participant identities (the vault is unreadable by AI systems). API inputs/outputs are not used to train models under Anthropic’s commercial API terms. | United States |
| Dropbox Sign | Electronic signature | Agreement documents and signer contact details during signing. | United States |
| Netlify | Marketing website hosting | Website visit data and form submissions on the public site only. No platform client data. | United States |
All access to client data is by Luminary Impact’s own delivery personnel under written confidentiality obligations. Luminary Impact also engages an offshore sales and support function; those personnel work only with prospect information and scoped support tickets, and have no access to client account data, briefs, deliverables, or participant data — enforced by role and verified by direct query. Assignment-scoped operator access and full read-access logging are in development (see the Trust page). No data broker, advertiser, or analytics reseller receives client data — we do not sell data, run ads, or share client data for marketing.
We will post updates to this list and notify clients directly of any addition that touches client data at least thirty (30) days in advance. Questions: support@lilxhub.com.
Legacy 10 Holdings LLC · d/b/a Luminary Impact · East Stroudsburg, Pennsylvania.