Lavicon | Subprocessors

Last updated: October 29, 2026

This page lists the service providers that process personal data on behalf of Pierre Debski, trading as dkp-consult, publisher of Lavicon and data controller. For each of them: its role, the data concerned and its location. A data processing agreement (article 28 GDPR) is in place with each provider listed in section 1. This page completes section 4 of the privacy policy.

1. List of Processors

Hostinger

Hostinger International Ltd (Cyprus)

Role: Rental of the virtual private server (VPS) that runs the website, the application, the API and the database.
Data concerned: All the data of the service: account data, the prompts you enter and the icons and animations generated from them, purchase and invoice records, technical logs.
Location: A Hostinger data centre. The exact region of the server is not stated on this page yet; it will be added once confirmed.

Coolify Cloud

coolLabs Technologies

Role: Management of the server and of the deployments: Coolify Cloud connects to our server to install, update and restart the website, the application and the API.
Data concerned: Administrative access to the server and to the configuration of the applications. Through this access it can technically reach the data stored on the server, although its role is limited to running the deployments.
Location: Not confirmed on this page yet.

OpenAI

Role: Generation of the icon images.
Data concerned: The prompt you enter for a generation, together with our own generation instructions. Your email address and your name are not sent.
Location: United States.

Runway

Runway AI

Role: Animation of the generated icons, when you ask for an animated icon.
Data concerned: The generated image and the animation prompt. Your email address and your name are not sent.
Location: United States.

Stripe

Stripe Payments Europe, Limited (Ireland), with Stripe, Inc. (United States)

Role: Payment of credit packs, on a payment page hosted by Stripe. For some obligations of its own (fraud prevention, financial regulations), Stripe acts as an independent controller.
Data concerned: Your email address, the purchase and its amount, the payment status. Card details are entered on Stripe and never reach our servers.
Location: Ireland and United States.

PostHog

PostHog, Inc., PostHog Cloud EU offering

Role: Audience measurement and product analytics, as described in section 6 of the privacy policy.
Data concerned: Pages visited and actions taken on the website and in the application. If you accept analytics cookies: a cookie identifier, the link to your account (internal user identifier, email address, username, role) and session recordings in which form fields and texts showing personal data are masked. Events recorded by our servers are linked to your internal user identifier.
Location: European Union (PostHog Cloud EU). PostHog, Inc. being a US company, access from the United States remains possible.

Resend

Resend, Inc. (United States)

Role: Sending of the emails of the service: welcome email, password reset and messages about your account.
Data concerned: Your email address, your username and the content of the email.
Location: Not confirmed on this page yet.

Google Workspace

Google

Role: Hosting of the contact@lavicon.dev mailbox, which receives your questions, your GDPR requests and your replies to our emails.
Data concerned: Your email address, your name and the content of the emails you send us, including attachments.
Location: Google infrastructure; data may be processed outside the European Economic Area.

2. Transfers outside the EEA

When a provider processes data outside the European Economic Area, or may access it from outside the EEA, the transfer relies on the safeguards of Chapter V of the GDPR set out in its data processing agreement, such as the European Commission's standard contractual clauses or, for certified US companies, the EU-US Data Privacy Framework.

3. Services Acting in Their Own Name

Sign in with Google. If you choose to sign in to the application with your Google account, Google authenticates you and sends us your email address and your Google account identifier. Google then acts as an independent controller for your Google account, under its own privacy policy; it is not a processor of the publisher.

4. Audit Log

Security and billing events (for example account creation, sign-in, purchases) are recorded in Recalled, an audit log service operated by the publisher himself. These events identify accounts by internal identifiers only: they contain no email address, no name, no IP address and no user agent. Some of them are relayed as notifications to a private Discord channel used by the publisher.

5. Changes to this List

Any addition or replacement of a provider is reflected on this page, with the date of the update. For any question about this list, or to obtain the safeguards that apply to a provider, contact us at contact@lavicon.dev.