1. Operator and scope
Luximio is operated by Glenn Chiu trading as Dot Square, KvK 51738856, Kon. Wilhelminaplein 248, 1062 KS Amsterdam, The Netherlands. Contact legal [at] luximio.com; replace [at] with @ and remove spaces.
This schedule distinguishes suppliers handling data on customer instructions from recipients involved in Dot Square’s own account, billing and security work. It forms part of a customer agreement only when the exact version is attached and accepted.
2. Direct processing suppliers
Cloudflare, Inc.
Provides the current website, dashboard, resolver/fallback hosting, D1/KV storage, network/security services and transactional email. For customer-directed work, possible data includes links/configuration, collaboration, usage events and necessary request metadata. Cloudflare’s DPA supports processor and subprocessor roles. It is a US supplier with international operations. Dashboard D1 has EU jurisdiction; that does not make all processing EU-only.
One.com Group AB
Hosts the receiving mailbox and correspondence. It is a customer-data subprocessor only where customer-controlled information is needed in support; ordinary enquiries are Dot Square’s controller activity. One.com identifies a Swedish contracting entity and states EU customer hosting is in Denmark. Its DPA addresses applicable onward processing and transfer safeguards. The account uses Basic Mail; the inactive restore add-on does not mean no backups exist.
3. Published downstream context
Our direct providers publish the following entries relevant to their service categories. These are published possible processing locations, not evidence that every Luximio record reaches every company or country. Their registers also cover services Luximio does not use.
| Register and entity | Listed role | Published locations |
|---|---|---|
| Cloudflare: Google LLC | Developer Platform, among other products | EEA, United States, Australia, India |
| Cloudflare: Oracle America, Inc. | Developer Platform and Cache Reserve | United States, EEA, UK, Japan, Australia, Canada, Singapore |
| One.com: Global Connect A/S | Datacenter | Denmark |
| One.com: Interxion | Datacenter and points of presence | Datacenter: Denmark; points of presence: Denmark, UK, Netherlands, France, Germany |
| One.com: Equinix | Point of presence | Sweden |
Sources: Cloudflare’s service-specific register and One.com DPA Schedule 3. One.com’s abbreviated names are reproduced as published, without inventing corporate suffixes. Relevant support, affiliate or additional onward operations are assessed under the provider agreements; these selected entries are not a claim of a complete account-routing trace. Ask our privacy contact for the applicable processing-chain information.
4. Other recipient roles
Stripe/Link: hosted Checkout, subscription administration and Managed Payments sold through Link. Sold through Link, LLC acts as merchant of record; the applicable Stripe entity and buyer terms are identified in Checkout. Merchant, financial, transaction-support, fraud and legal activities have independent-controller purposes. The Dutch-account DPA names Stripe Payments Europe, Limited for its applicable processor role; financial-services terms also identify Stripe Technology Europe, Limited. Do not treat every payment activity as customer-instructed subprocessing. See the DPA, privacy notice and Sold through Link buyer terms. Historical sandbox records remain separately labelled and subject to their retention review.
Cloudflare Turnstile: protects contact submissions. Its privacy addendum distinguishes processing for site protection from Cloudflare’s separate controller purpose of improving bot detection.
Cloudflare public DNS: link-health probes submit configured hostnames for lookups. That public-resolver service has separate terms and purposes from paid database hosting.
Apple and Google: app integrations may use native attestation/integrity services; these require assessment of the enabled app flow and provider roles. A customer’s own destination, app store or invited mailbox is not automatically a Dot Square-appointed subprocessor.
5. Previous hosting
The former OpenAI Sites dashboard and its database were permanently deleted on 25 September 2026 after the move to direct Cloudflare. OpenAI Sites no longer hosts or authenticates the current dashboard. Historical provider backup/log expiry has not been independently verified. Separate older private marketing and fallback previews remain in the inventory. Development conversations are a separate workflow, not an inference API in the Luximio product.
6. Changes and contact
For an accepted customer processing agreement, Dot Square provides specific written notice of an intended supplier addition/replacement at least 14 calendar days before affected data is processed, with meaningful information and an opportunity to object. It checks relevant provider notices daily and informs affected customers within two calendar days. Requested objections within five days support upstream escalation but do not waive later reasonable objections before processing begins. Unresolved concerns must be addressed before the affected processing proceeds.
Retain this dated schedule with the agreement. The website copy alone does not execute or amend a customer contract. For data-use or rights questions, see the privacy notice or contact the legal address above.