lemongraph

Sub-processors

Last updated: September 28, 2026

Lemongraph uses the third party providers listed below to deliver the service. Each one is bound by contract to protect your data and to use it only on Lemongraph’s instructions. This page names every provider that receives customer data, what it receives and why it receives it.

This list supports the Privacy Policy, which explains what Lemongraph collects and what it is used for.

Providers that process mail and calendar content

These providers handle the content of your Gmail messages and Google Calendar events. None of them are permitted to use your data to train generalized AI or machine learning models.

OpenAI

  • Purpose: generating agent decisions and replies, and producing the embeddings used to match and retrieve prior context.
  • Receives: the message bodies, subjects, attachments and calendar events an agent is reasoning about, together with the working memory it has built for your account.
  • Location: United States.
  • Training: excluded. The agreement with OpenAI does not permit your data to be used to train or improve their models.

Langfuse

  • Purpose: recording agent requests and responses, so incorrect behaviour can be debugged and the product improved.
  • Receives: the same content sent to the model provider, as trace records. Email addresses, phone numbers, payment card numbers, IP addresses and access tokens are removed before these records leave the Lemongraph systems. The surrounding text is retained, so treat these records as containing your content in de-identified form.
  • Location: European Union.

Google Cloud

  • Purpose: hosting the application, its database, its queues and its file storage. This is where your data lives at rest. It also delivers the notifications that signal new mail has arrived, so that an agent can wake and respond.
  • Receives: all customer data, including account information, mail and calendar content, attachments and agent memory.
  • Location: United States, in the us-central1 region.

Providers that do not receive mail or calendar content

These providers support the service but never receive the contents of your mail or events.

Exa

  • Purpose: web search, when an agent needs public information to do its work.
  • Receives: the search terms the agent composed. No message or event content is sent.

Logo.dev

  • Purpose: showing your company logo in the app.
  • Receives: the domain portion of your work email address, meaning the part after the @ sign. The address itself is never sent, and personal Gmail addresses are excluded entirely.

Vercel

  • Purpose: hosting this public website.
  • Receives: ordinary web request information from visitors to these marketing pages. No customer data from the application.

Changes to this list

This page is updated whenever a provider is added or removed. Under a data processing agreement, notice goes out before a provider that processes your mail or calendar content is added, so there is an opportunity to object.

Contact

For questions about this list or to request notification of changes, write to hey@lemongraph.dev.