Sub-processors

LEXAI uses third-party services to deliver parts of the platform (database, AI, lawyer-subscription billing, email, messaging, observability). UAE PDPL Art. 6 requires us to disclose every external processor that handles your personal data, the purpose, and the data residency. This page is the canonical list. We update it whenever a new sub-processor is added or an existing one rotates infrastructure.

Last reviewed: 2026-08-12

Role: Database hosting (Postgres) + auth + storage

Data category: All structured platform data + uploaded files

Data residency: Sydney, Australia (ap-southeast-2)

Data Processing Agreement: https://supabase.com/legal/dpa

Role: Application hosting + AI Gateway routing + Edge / Serverless functions + web analytics (Vercel Analytics / Speed Insights, loaded only after analytics-cookie consent)

Data category: Request metadata, runtime logs, AI request payloads (transit-only), and post-consent page-view + performance beacons (IP address + page path)

Data residency: Multiple Vercel edge regions (configurable). AI Gateway: US-East primary

Data Processing Agreement: https://vercel.com/legal/dpa

Role: AI model provider (Claude Haiku 4.5, Claude Sonnet 4.6) for legal Q&A, document analysis, and document translation

Data category: User chat messages + uploaded documents (not used to train models)

Data residency: United States

Data Processing Agreement: https://www.anthropic.com/legal/dpa

Role: Embedding model (text-embedding-3-large) for legislation retrieval

Data category: Legal text fragments + user chat queries (transit-only via Vercel AI Gateway)

Data residency: United States

Data Processing Agreement: https://openai.com/policies/data-processing-addendum

Role: Live web-search fallback for the AI legal assistant when no source exists in our legal database

Data category: The text of the legal question only — never your name, email, or account identifiers

Data residency: United States (New York)

Data Processing Agreement: https://www.tavily.com/privacy

Role: Lawyer subscription billing, client document-translation order payments (pay-after-preview), and payments for LEXAI's own digital products such as checklists and guides; see our Refund & Cancellation Policy

Data category: Lawyer subscription amounts, lawyer billing email, lawyer billing address; translation order amounts + payer email address; LEXAI product order amounts + buyer email address

Data residency: Stripe-managed regions

Data Processing Agreement: https://stripe.com/legal/dpa

Role: Transactional email delivery

Data category: Recipient email addresses + email content (account, notification, system)

Data residency: United States (AWS us-east-1)

Data Processing Agreement: https://resend.com/legal/dpa

Role: Real-time messaging between clients and lawyers

Data category: Chat messages, attachments, user IDs, presence

Data residency: Multiple regions; data localisation per Stream account

Data Processing Agreement: https://getstream.io/legal/dpa

Role: Error monitoring + performance observability

Data category: Error stack traces + breadcrumbs (PDPL-safe primitives only — no message content)

Data residency: United States

Data Processing Agreement: https://sentry.io/legal/dpa

Role: Product analytics (event funnel, retention)

Data category: PII-free events: page views, feature interactions, slug + count props

Data residency: European Union (eu.i.posthog.com)

Data Processing Agreement: https://posthog.com/dpa

Role: Session replay + behavioural analytics (click / scroll heatmaps, interaction recordings)

Data category: Session recordings + interaction events (loaded only after analytics-cookie consent)

Data residency: United States

Data Processing Agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA

Role: Advertising conversion measurement for paid-search campaigns (loaded only after you accept cookies)

Data category: Cookie / click identifiers + a conversion event (e.g. a founding-member reservation). The browser tag sends no name, email, or phone

Data residency: United States / global Google infrastructure

Data Processing Agreement: https://business.safety.google/adsprocessorterms/

Several sub-processors above are based outside the UAE (Anthropic, OpenAI, Resend, Sentry — United States; Vercel — multi-region; PostHog — European Union). UAE PDPL Art. 22–26 permit transfers to such jurisdictions when (a) explicit user consent is provided, (b) the processor maintains adequate safeguards (DPA + technical controls), and (c) data minimisation is enforced.

For AI processing specifically, queries are routed through Vercel AI Gateway to Anthropic Claude. We send only what is needed to answer your question, and your data is not used to train models. See our Privacy Policy section "AI Data Handling" for details.

If you object to any sub-processor's involvement, contact info@lexaidxb.com. Note that some sub-processors (Supabase, Vercel) are essential infrastructure — objecting effectively means we cannot continue providing the service. Stripe processes lawyer-subscription billing, client document-translation order payments, and payments for LEXAI's own digital products such as checklists and guides; it never receives consultation content, case details, or chat messages. Analytics sub-processors (PostHog, Microsoft Clarity, Google) are non-essential: their in-browser trackers load only if you accept analytics cookies, and you can decline or withdraw that consent at any time via the cookie banner. PostHog additionally receives PII-free server-side service events (identifiers and counts only — never your name, email, or phone). Error monitoring (Sentry) receives no message content or personal identifiers.

All PDPL rights requests (access, rectification, erasure, portability, objection), questions about sub-processors, cross-border transfer concerns, and breach notifications should be directed to LEXAI's Data Protection Officer:

Email: info@lexaidxb.com Location: Dubai, United Arab Emirates Response window: within 30 days of receipt (our service commitment).

LEXAI operates a single unified inbox covering DPO, security disclosure, and general support; messages tagged "PDPL" or "DPO" in the subject line are routed to the data-protection workflow.