Subprocessor List

This Subprocessor List identifies affiliates and third-party service providers that Lythe Inc. or its applicable affiliate, including Lythe Pte. Ltd. (collectively and as applicable, "Lythe"), may engage to process Customer Personal Data in connection with Fraser Simulation Studio and related Lythe services (collectively, the "Services").

Lythe Inc. provides Lythe's self-serve Services worldwide. Lythe Pte. Ltd., Lythe's Singapore subsidiary, may process Customer Personal Data as an affiliate subprocessor or may separately provide contracted Services where expressly identified in an applicable Order Form, customer agreement, Terms of Service, or other written agreement.

This Subprocessor List should be read together with the Lythe Privacy Policy, the applicable Terms of Service, and any applicable Data Processing Addendum ("DPA") or customer agreement.

"Customer Personal Data" means personal data included in Customer Data and processed by Lythe on behalf of a customer through or in connection with the Services.

"Subprocessor" means an affiliate or third-party service provider engaged by Lythe to process Customer Personal Data on behalf of a customer in connection with the Services.

Capitalized terms not defined in this Subprocessor List have the meanings given in the applicable DPA, Terms of Service, Privacy Policy, Order Form, or customer agreement.

The following providers may process Customer Personal Data depending on the features, integrations, deployment environment, and customer configuration used. A provider will process only the categories of data reasonably necessary for the stated purpose.

Amazon Web Services, Inc.

• Primary purpose: Cloud infrastructure, compute, storage, networking, backups, and security services where used.
• Data categories: Customer Data, uploaded materials, application data, logs, metadata, and backups.
• Processing location / notes: United States and other configured AWS regions, depending on deployment.

Cloudflare, Inc.

• Primary purpose: Content delivery, DNS, web security, traffic management, bot protection, and network performance.
• Data categories: IP addresses, request metadata, device and browser information, security events, and limited content transmitted through the network.
• Processing location / notes: Global network; processing location depends on traffic routing and service configuration.

PostHog, Inc.

• Primary purpose: Product analytics, event analytics, feature-usage measurement, debugging, and session replay where enabled.
• Data categories: Device and browser information, identifiers, page activity, navigation paths, interaction events, feature usage, and session replay data.
• Processing location / notes: United States - PostHog US Cloud. Analytics and session replay are subject to applicable consent choices.

Lythe Pte. Ltd.

• Primary purpose: Engineering, customer support, operations, administration, and security services where required to provide the Services
• Data categories: Customer Personal Data, account information, support records, technical logs, and other data necessary to provide the Services
• Processing location / notes: Singapore. Acts as an affiliate subprocessor of Lythe Inc. unless Lythe Pte. Ltd. is separately identified as the contracting entity in the applicable agreement.

Microsoft Azure

• Primary purpose: Cloud infrastructure, compute, storage, networking, security, and related platform services where used.
• Data categories: Customer Data, uploaded materials, application data, logs, metadata, and backups.
• Processing location / notes: United States and other configured Azure regions, depending on deployment.

Google Cloud Platform

• Primary purpose: Cloud infrastructure, compute, storage, networking, analytics, and related platform services where used.
• Data categories: Customer Data, uploaded materials, application data, logs, metadata, and backups.
• Processing location / notes: United States and other configured Google Cloud regions, depending on deployment.

Vercel

• Primary purpose: Application hosting, deployment, content delivery, serverless infrastructure, and performance monitoring.
• Data categories: Account and usage data, application requests, IP addresses, technical logs, and limited Customer Data processed through hosted application functions.
• Processing location / notes: United States and global infrastructure, depending on routing and configuration.

Stripe

• Primary purpose: Payment processing, subscription management, invoicing, billing, fraud prevention, and related payment operations.
• Data categories: Billing contacts, customer and subscription identifiers, transaction information, payment status, fraud-prevention data, and limited payment tokens.
• Processing location / notes: United States and other locations used by Stripe. Stripe may act as an independent controller or service provider for certain payment data.

Customers may choose to connect the Services with third-party systems such as CRMs, analytics platforms, design tools, helpdesks, data warehouses, source-code repositories, issue trackers, or other customer-selected integrations. Where a customer selects, configures, and controls an integration under its own account or agreement, that provider may not be a Lythe Subprocessor and may instead process data under the customer's direct instructions and contractual relationship.

Where Lythe independently engages an integration provider to process Customer Personal Data on Lythe's behalf as part of the Services, Lythe will add that provider to this Subprocessor List where required.

Lythe does not permit third-party AI, model, transcription, or infrastructure providers to use Customer Personal Data, customer-provided call recordings, transcripts, research data, simulation inputs, AI persona outputs, or other personal data processed through the Services to train their models.

Where Lythe introduces an AI, transcription, or model provider that processes Customer Personal Data on Lythe's behalf, Lythe will identify the provider in this Subprocessor List or otherwise provide the notice required by the applicable DPA or customer agreement.

Customer Personal Data may be processed in the United States, Singapore, and other countries in which authorized Subprocessors operate. Where required by applicable law or the applicable DPA, Lythe will implement appropriate safeguards for cross-border transfers, which may include contractual protections, data processing agreements, standard contractual clauses, transfer assessments, or other recognized transfer mechanisms.

Lythe may update this Subprocessor List from time to time as providers, features, or processing arrangements change. Where required by an applicable DPA or customer agreement, Lythe will provide notice of an intended addition or replacement of a Subprocessor through an updated Subprocessor List, email, product notice, or another agreed method at least thirty (30) days before the new Subprocessor begins processing Customer Personal Data, unless an emergency replacement is reasonably necessary for security, availability, or service continuity.

A customer may object to a new Subprocessor on reasonable data-protection grounds by contacting Lythe within fifteen (15) days after receiving notice. Lythe and the customer will work in good faith to address the objection in accordance with the applicable DPA or customer agreement.

Questions about this Subprocessor List or Lythe's processing of Customer Personal Data may be directed to:

• Company: Lythe Inc.
• Privacy and DPA contact: team@lythe.ai
• Singapore affiliate: Lythe Pte. Ltd.