Updated 15 October 2026
Subprocessors
These are the providers that process personal data for Bolted LLC to run LensRE. Each works only for the purpose listed and only on our instructions, under a data processing agreement except where its row says otherwise. How we use personal data, and why, is in the Privacy policy.
Who they are
| Provider | What it does for LensRE | Personal data it receives | Where | Transfer basis | Its terms |
|---|---|---|---|---|---|
| Cloudflare, Inc. (USA) | Runs the app, lensre.com and listing sites; stores our database and files; processes images; checks listing-site forms and lensre.com’s demo form for spam (Turnstile); connects custom domains; keeps server logs; forwards email sent to hello@lensre.com; stores demo requests. | Everything LensRE holds; the IP address and browser details of each request; Turnstile's spam-check signals. | Database and files stored in the EU (Cloudflare's EU jurisdiction). Requests are handled at the Cloudflare location nearest the visitor. Demo requests are stored in Workers KV, which isn't tied to a region. | EU–US Data Privacy Framework; Standard Contractual Clauses | DPA · Its subprocessors |
| OpenAI (OpenAI Ireland Ltd; OpenAI OpCo, LLC, USA) | Relights photos (GPT Image 2.5) and checks each edit (a vision model compares it with the photo as taken). | Resized copies of photos, without location or camera metadata; LensRE's instructions. Not used for training; kept up to 30 days for abuse monitoring. | United States | Standard Contractual Clauses | DPA · Its subprocessors |
| Replicate, LLC (USA, a Cloudflare company) | Finds the sky, windows and objects in a photo and estimates depth, at upload and with each relight; runs the fallback relight model (Seedream 5 Pro) when OpenAI can't. | Resized copies of photos, without location or camera metadata; LensRE's instructions. Deleted by Replicate after an hour. | United States | Data processing agreement and Standard Contractual Clauses requested, not yet signed | Privacy policy · Data retention |
| TypeSafe AI, Inc. (USA), maker of Jev | Makes LensRE's decisions: at upload, it looks at each photo (what it shows, the lights that suit it, what could identify someone, such as a face, a licence plate or a house number, and where movable clutter sits); whether an edit changed the property; how a listing site is laid out, and checks on its text; what a typed request means; and what a buyer's message asks for. | Each photo at upload, published or not, as a resized copy without metadata; written descriptions of photos; listing and site text; the text typed in the command menu; a buyer's message with the listing's name or street (never the buyer's name or contact details). Not used for training; kept as long as necessary for the processing, with no fixed period. | United States | Standard Contractual Clauses (modules 2 and 3) | DPA · Its subprocessors |
| Resend (Plus Five Five, Inc., USA) | Sends sign-in emails, buyers' messages to agents, and demo-request emails; keeps the demo-request contact list. | Email addresses and the emails' content (for a buyer's message: their name, contact details and message); demo contacts (email, name, language, listing volume). Sending logs kept 30 days. | United States; mail is sent from Ireland (EU) | EU–US Data Privacy Framework; Standard Contractual Clauses | DPA · Its subprocessors |
| Stripe | Takes payments; runs subscriptions, invoices and the billing portal; calculates VAT and sales tax (Stripe Tax). | Name, email, billing address, VAT or tax ID, card details (which LensRE never sees), invoices and payment history. Stripe is also a controller for its own fraud prevention and legal compliance. | The EU, the United States and other countries where Stripe operates | EU–US Data Privacy Framework; Standard Contractual Clauses | DPA · Its subprocessors |
| Fathom Analytics (Conva Ventures Inc., Canada) | Counts visits to lensre.com and the app, without cookies. | The page, the referring site, browser and device type, country; the IP address and browser string, hashed with a salt that changes daily and never stored. | Canada; EU visitors' data is processed in the EU (Slovenia) and anonymised there | EU adequacy decision for Canada | DPA · Privacy policy |
| Google LLC (USA), Gmail | Receives the email sent to hello@lensre.com, which Cloudflare forwards to it. | Your email address and what you write to us. | United States and other countries where Google operates | EU–US Data Privacy Framework; no data processing agreement yet (a personal mailbox, moving to a business one) | Privacy policy |
Where data lives
LensRE's database and files are stored in the European Union. The providers in the United States receive only what each step needs: resized photos without location or camera data, text, and the email addresses and messages they deliver.
Bolted LLC, which runs LensRE, is a US company. How personal data from the EU reaches it, and on what basis, is in section 10 of the Privacy policy.
Some things never reach a provider: nothing from a demo workspace goes to OpenAI, Replicate, TypeSafe or Resend; the sample listing is never sent; demo listing sites keep no buyer's name, contact details or message; listing sites load no analytics and set no cookies; and nobody but Stripe sees a card number.
Changes
We update this page before a new provider starts processing personal data. Agents get at least 14 days' notice by email and may object, as our Data processing agreement sets out. Questions: hello@lensre.com.