Maintained by Aquafruit Media Pty Ltd (ABN 72 126 463 434), Suite 151, 139 Cardigan Street, Carlton VIC 3053, Australia. Last updated: 11 July 2026.
This page lists the subprocessors Aquafruit engages to operate aquafruit.io and the Talora AI assistant. Personal information is handled in accordance with our Privacy Policy and the Australian Privacy Principles. A summary of the security controls we apply is on our Security page.
Subprocessors specific to the Aquafruit Growth Engine client platform are listed separately, in documentation provided to Growth Engine customers.
Application infrastructure
| Subprocessor | Purpose | Data categories | Processing location |
|---|---|---|---|
| Lovable (application platform) | Hosting for aquafruit.io, including managed database, authentication, file storage, and serverless functions. | Site content, article drafts, admin accounts, Talora chat transcripts, contact form submissions. | Australia / United States |
| Lovable AI Gateway | Routing layer that carries AI requests from the website to the model providers listed below. | Prompts and responses transiting to/from AI models on behalf of Aquafruit. | United States |
Underlying cloud & developer infrastructure
| Subprocessor | Purpose | Data categories | Processing location |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Underlying cloud infrastructure that hosts the managed database, storage and serverless functions provided to Aquafruit via the Lovable Cloud / Supabase platform. Aquafruit's preferred region is Sydney (ap-southeast-2). | All application data at rest and in transit within the managed backend (site content, article drafts, admin accounts, Talora chat transcripts, contact form submissions). | Australia (Sydney) preferred, with US failover per platform defaults |
| Microsoft Corporation — GitHub | Source code repository and CI/CD used by Aquafruit engineering to build and deploy the website. No end-user personal data is stored in the repository. | Application source code, infrastructure-as-code, and non-personal configuration. Anonymised analytics events may be defined in code but no visitor PII is stored here. | United States |
| Microsoft Corporation — LinkedIn | Destination social network to which Aquafruit admins publish posts through Zoho Social. Also the source of profile links surfaced in the site footer. | Post copy and media assets that Aquafruit admins choose to publish, plus OAuth tokens held by Zoho Social for the connected LinkedIn page. | United States |
AI model providers
| Subprocessor | Purpose | Data categories | Processing location |
|---|---|---|---|
| Google — Gemini models (via Lovable AI Gateway) | Language model responses for the Talora chat widget, long-form article generation, and section-level content generation. | User messages sent to Talora, prompts issued by Aquafruit admins for article generation, and the resulting model outputs. | United States |
| ElevenLabs | Text-to-speech synthesis of Talora's voice responses, and speech-to-text transcription of push-to-talk voice input. | Text of Talora replies sent for voice synthesis; short audio clips of user voice input sent for transcription. | United States |
Analytics
| Subprocessor | Purpose | Data categories | Processing location |
|---|---|---|---|
| Google Analytics 4 (Google LLC) | Aggregate website analytics (page views, scroll depth, campaign attribution). Loaded only after cookie consent is granted. | Cookie identifiers, IP address, page URLs, referrer, device and browser metadata. | United States |
| Zoho Analytics (Zoho Corporation) | Consolidated internal reporting across website, CRM and marketing data sources used by Aquafruit admins for performance analysis. Not exposed to site visitors. | Aggregated and pseudonymised metrics drawn from GA4, Zoho CRM and campaign tooling. No raw visitor identifiers are pushed to Zoho Analytics beyond what already exists in the connected source systems. | United States / India |
Advertising
| Subprocessor | Purpose | Data categories | Processing location |
|---|---|---|---|
| Google Ads (Google LLC) | Paid search and display advertising, conversion measurement, and remarketing audiences for aquafruit.io. Advertising tags load only after cookie consent is granted. | Cookie identifiers, click identifiers (gclid), IP address, conversion events, and device/browser metadata for users arriving from or targeted by Google Ads campaigns. | United States |
Business operations
| Subprocessor | Purpose | Data categories | Processing location |
|---|---|---|---|
| Zoho CRM (Zoho Corporation) | Customer relationship management and lead capture from the website contact form. | Name, email address, phone number, company, message content, engagement records. | United States / India |
| Zoho Mail / Campaigns (Zoho Corporation) | Transactional email delivery and, where opted in, marketing email campaigns. | Email address, name, message content, open/click engagement metadata. | United States / India |
| Zoho Social (Zoho Corporation) | Scheduling and publishing of social media posts composed by Aquafruit admins to connected channels (e.g. LinkedIn). | Post copy, media assets uploaded for publication, and OAuth tokens for the connected social channels. | United States / India |
Content delivery
| Subprocessor | Purpose | Data categories | Processing location |
|---|---|---|---|
| Cloudflare, Inc. | Global edge network / CDN, TLS termination, and DDoS protection sitting in front of aquafruit.io via the Lovable hosting layer. | Anonymous request metadata (IP address, user agent, request headers, TLS metadata) required to route and protect traffic. No account is created for site visitors. | Global edge (United States headquartered) |
| Google Fonts (Google LLC) | Delivery of the web fonts used across aquafruit.io (Montserrat, Space Grotesk, DM Sans). | Anonymous request metadata (IP address, user agent) required to serve font files. No account or cookie is set. | United States (global CDN) |
Stock media providers
| Subprocessor | Purpose | Data categories | Processing location |
|---|---|---|---|
| Pexels (Pexels GmbH) | Third-party stock photography library used for illustrative imagery accompanying articles and editorial content. Images are fetched via the Pexels API and re-hosted on Aquafruit infrastructure with visible photographer and source attribution. | No personal information of site visitors is sent to Pexels. Aquafruit issues authenticated API queries (keyword, orientation) to retrieve licensed imagery. | European Union (Germany) |
Notifying you of changes
Aquafruit reviews this list on an ongoing basis. Where we add or change a subprocessor in a way that materially affects how your personal information is handled, we will update this page and, where appropriate, notify you.
Questions about this list, or requests for a data processing agreement, can be sent to [email protected].
This page is app-owned editable content, not an independent certification. Nothing on this page overrides any Non-Excludable Right under the Australian Consumer Law, and nothing on this page varies any Services Agreement or subscription order form in place between you and Aquafruit.