Subprocessors

• Lovable Cloud — application hosting, serverless functions, managed database, object storage, authentication, and secrets management. Data is stored in the region selected for the organization workspace.

• Lovable managed email — authentication and transactional email delivery using the organization's configured sender domain (for example notify.accrueaba.com). Lovable handles SPF, DKIM, bounce/complaint processing, and unsubscribe management.

• Paddle — subscription billing, checkout, tax, invoicing, and merchant-of-record services. Accrue ABA does not store card numbers.

• Lovable AI Gateway — optional clinical decision-support drafting in Accrue Care. Only de-identified context (goal titles, behavior counts, trial accuracy, and session metadata) is sent. Full names, dates of birth, and other identifiers are not included in prompts.

• Web Push protocol — browser-native push notifications delivered through the device or browser vendor's push service. No third-party push SDK is used.

We will notify organization administrators of material changes to this subprocessor list through the email address associated with the organization and, when practical, through an in-app notice.

For subprocessor, data processing, or school-agreement questions, contact your organization administrator or see the Security & Compliance page.