DraftDraft — pending legal review. This document describes how Lifecycle works today and is not yet final. Questions: legal@lifecycle.lol.
Legal
Subprocessors
The third parties that process personal data when Lifecycle runs the hosted Cloud service or bills a subscription, and the integrations a customer can choose to connect.
Last updated: September 28, 2026
1. Engaged by Lifecycle
These providers help us host Cloud desks, store their data, sign people in, and take payment. They apply to Cloud customers and to anyone who buys a subscription. On-prem desks store their data on your own server; for them, only billing, sign-in, and license heartbeats reach these providers.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Vercel, Inc. | Hosts lifecycle.lol and every hosted desk at lifecycle.lol/<name>: web servers, serverless functions, runtime logs, and custom-domain routing. | All Cloud Customer Content while it is processed; request metadata (IP address, user agent, timestamps) and redacted diagnostic logs. | United States |
| Neon, Inc. (managed Postgres) | Primary database for Cloud desks, accounts, subscriptions, license records, and on-prem license heartbeats. | All Cloud Customer Content at rest, account and billing records, license heartbeat telemetry. | United States |
| Supabase, Inc. (managed Postgres) | Shared database used when a hosted desk or a linked on-prem node is configured for cloud sync of instance requests. | Create-instance and portal request rows (names, work email addresses, instance names) and linked-node status. | United States |
| Microsoft Corporation | Sign in with Microsoft (Entra ID) and Microsoft Graph calls into your tenant with the permissions your admin consents to: directory users and groups, Intune managed devices, and sending mail as a mailbox you choose. | Identity claims (name, email, user principal name, tenant id); directory attributes; device serial numbers and names; outbound email content. | United States / Microsoft datacenter for your tenant |
| Stripe, Inc. | Card checkout, subscriptions, invoices, and payment status webhooks. | Billing email and name, plan, instance name, payment method (held by Stripe, never by Lifecycle). | United States |
| PayPal, Inc. | PayPal checkout and subscription status webhooks. | Billing email, plan, instance name; PayPal account details stay with PayPal. | United States |
| Cloudflare, Inc. | DNS for lifecycle.lol, and Cloudflare Tunnel when an on-prem desk is published on a *.lifecycle.lol name. | DNS queries; for tunneled on-prem desks, encrypted desk traffic in transit. | Global edge network |
| 17TRACK (YQ Tech Ltd.) | Looks up delivery status when IT refreshes a tracking number on a ticket. | Carrier tracking numbers only. | China / global |
2. Integrations you turn on
These services are used only when your administrator connects them, usually with your organization's own account and credentials. Lifecycle sends data to them on your instruction. Your agreement with each provider governs how they handle it.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| eBay Inc. | Publishes a retired-device listing through the eBay Sell API when you add eBay credentials. | Listing title, description, price, condition, and shipping text. Device photos and employee discount codes are not sent. | United States |
| USPS, FedEx, UPS | Creates shipping labels with your carrier account. | Recipient name, shipping address, phone, package details. | United States |
| Dell Technologies | Warranty lookup with your Dell API credentials. | Device service tags. | United States |
| Google Workspace (Admin SDK) | Deprovisions a Chromebook during retire with your service account. | ChromeOS device serial numbers and ids. | United States / global |
| ImmyBot | Matches PCs and build tags on your ImmyBot instance. | Employee email, device serials and names. | Your ImmyBot tenant |
| Your mail server (Microsoft 365 or SMTP) | Sends portal links, reminders, invites, and ticket email. Lifecycle does not operate its own email provider. | Recipient addresses and message content. | Your mail provider |
3. What we do not use
Lifecycle does not run its own email-sending provider: desk mail goes out through your Microsoft 365 mailbox or your SMTP server. We do not use advertising networks, analytics trackers, or data brokers, and we do not sell personal information.
4. Changes to this list
We will update this page before a new subprocessor starts handling Customer Content and change the date above. Customers with a signed Data Processing Addendum can object to a new subprocessor as described there. Questions: privacy@lifecycle.lol.