In short (not part of the list)
- Your business data stays on your PC. Only our e-mail provider and screen-sharing tool see personal data from it, and only what you send or show us for support.
- Cloudflare hosts our License Server and Resend sends our e-mails. Paddle (our Merchant of Record), the European Central Bank and, once the AI Assistant is available, Hugging Face are not our subprocessors.
- Providers of Coming Soon Features receive nothing until the feature is switched on; we add them here first.
- We update this page at least [30] days before a new subprocessor starts and e-mail every Customer with an active License.
LivingRoom Subprocessor List Draft 2 of 2026-10-25 - not yet in effect
This list is published by Point of the Mountain Software LLC, a Utah limited liability company ("Company", "we", "us", "our"), which makes and licenses its LivingRoom software ("Software"). It names the third parties that process personal data for the Software's online services, and others that receive some data but are not our subprocessors. It is a notice, not a contract, except where our Data Processing Addendum ("DPA") makes a statement in it binding. Capitalised words have the meaning given in our End User License Agreement ("EULA") and Privacy Policy. It is accurate as of the effective date above.
1. What this list covers
1.1 Customer Data is not hosted by us. It stays on your PC (or office server PC); we get no copy (EULA section 8.1) except what you show or send us (section 1.2), and no provider here stores it for us.
1.2 Two kinds of personal data reach our providers: License Data (Privacy Policy section 3), which we control and our providers process for us as service providers (processors); and support data: personal data from Customer Data that you show us in a Support Session (EULA section 10) or send us (for example a support file, EULA section 10.6), which we handle only on your instructions, under the DPA where it applies. A provider that carries support data for us is our subprocessor.
2. Our service providers and subprocessors
| Provider | Does | Personal data | Where | Role |
|---|---|---|---|---|
| Cloudflare, Inc. (privacy policy; DPA) | Hosts our License Server, the Reseller Portal [to be confirmed] and our Support Token tool, and stores their records | License records and License Check data (license ID; the License Key, which states the name, e-mail address and company it was issued to; each PC's Machine ID and first and last check dates); override codes; short-lived request counters; every connection's network (IP) address. Trial registrations (requester's name, e-mail address and business name, Trial end date; deleted 7 days after the Trial ends) [not yet released]. Once sales open [to be confirmed]: Paddle orders (buyer's name, e-mail address and business name, amount, currency, License Key), renewal consent records (the consent text with its version and SHA-256 fingerprint, time, e-mail address, Plan, transaction and Subscription IDs, when the Subscription ended; no network address; deleted 3 years after the Subscription ends, or after the consent if never linked to one) [not yet released] and New Business applications. Once the Reseller Portal opens [to be confirmed]: Reseller accounts, and the name, e-mail address and company of each customer a Reseller assigns a key to. The Support Token log (time, validity, fingerprint of the Installation's License Key; each entry deleted 3 years after issue) [to be confirmed] | United States; data centers worldwide; records not limited to one region [to be confirmed] | Service provider / processor (License Data). No Customer Data |
| Resend (Plus Five Five, Inc.) (DPA) [to be confirmed] | Sends our License Server's and Reseller Portal's e-mails, including Trial-ending notices and alerts to us | Each recipient's e-mail address and the message, which may contain a License Key, a name, a business name and an order number | United States (its DPA says its main processing is there) | Service provider / processor (License Data). No Customer Data |
| [E-MAIL PROVIDER], hosting [email protected] and [email protected] ([URL]) [to be confirmed] | Hosts our mailboxes | E-mails you send us with attachments (for example trial and privacy requests, support files, the Support Fingerprint, which is not your License Key: Support Policy section 9.3); our replies; order alerts and New Business applications our License Server sends us | [to be confirmed] | Processor (License Data); subprocessor for personal data from Customer Data you send us |
| [SCREEN-SHARING TOOL] ([URL]) [to be confirmed] | Carries the screen (and remote control, if you allow it) in a Support Session | Whatever is on the shared screen, which may include personal data from Customer Data, and connection details | [to be confirmed] | Subprocessor when we provide the tool; a tool you choose is your provider, not ours |
Our providers list their own subprocessors, for example Cloudflare (https://www.cloudflare.com/gdpr/subprocessors/) and Resend (https://resend.com/legal/subprocessors).
3. Third parties that receive data but are not our subprocessors
| Recipient | Why not our subprocessor | Receives | Where |
|---|---|---|---|
| Paddle (Paddle's Privacy Policy; data sharing addendum) | Our online reseller and Merchant of Record; Paddle's Privacy Policy names its own companies as controllers | All you enter at its checkout. From us: your e-mail address, contact name (or business name) and business name (New Business checkout); a Reseller's e-mail address, contact name and company (wholesale order); Paddle customer and subscription IDs and the Plan chosen (Manage subscription, Change plan, cancelling after a full refund or chargeback). Its checkout on the Reseller Portal sets Paddle's own cookies | United Kingdom, United States, Ireland, Canada (per Paddle's Privacy Policy) |
| Hugging Face, Inc. (privacy policy) | Hosts one AI Model's file, which the Software requests directly when an Admin downloads it; we send it nothing | Your PC's network address and the request (the file; a header identifying the program). Not in use in the current release: the AI Assistant is a Coming Soon Feature (not available) until we publish its model on our own download host (section 4), when it becomes a Beta Feature | United States (per its privacy policy); files may come from its download network |
| European Central Bank (privacy statement) | The Software downloads its public exchange-rate files directly; we send it nothing | Your PC's network address and the request; no business data. Once a day while a Company File that is not archived uses a currency other than your main one; once a purchase order in another currency has needed a rate, every day from then on; and whenever an Admin clicks "Fetch now" | Germany |
Spelling is checked on the PC, by Windows' own spellchecker or an English (US) dictionary that ships with the Software; no dictionary is downloaded. [not yet released]
Also not listed: Third-Party Services you connect and any sync tool behind an off-site copy folder an Admin sets for Backups (your providers, receiving data from your PC at your direction under your agreements); Resellers (Privacy Policy sections 2.3 and 6); advisers, authorities and a buyer of our business (Privacy Policy section 9).
4. Not in use yet
These providers receive nothing today. Before one receives personal data - when a release switches its feature on or, with your agreement, in a limited test (Beta and AI Terms, section B5) - we will add it to section 2 or 3, update our Privacy Policy and, for a subprocessor, give the notice in section 5.
| Feature | Provider | Would receive |
|---|---|---|
| AI Assistant online add-on | Not chosen [to be confirmed]; the only connection built is to the API of Anthropic, PBC (United States); our relay on Cloudflare | The question, the reports the assistant may read and the results needed (figures, product names and SKUs, vendor names, dates), and the currency. As designed, never buyers' or customers' names, addresses, e-mail addresses or phone numbers, users' names or keys; the Company File's name is replaced. The relay would keep a daily count of questions per License for 3 days, no content |
| Connection service (signing in to Walmart, QuickBooks Online and other services) | Cloudflare | Sign-in sessions (up to 15 minutes); access tokens awaiting your PC (encrypted, up to 10 minutes); Etsy read requests in transit; a request log (network address, country, browser, marketplace seller ID) kept 90 days |
| Phone companion over the internet | Cloudflare | Encrypted snapshots only your phone can open, kept 7 days; a hash of each upload token |
| Our own download host for AI Model files and updates [not yet available] | Cloudflare (R2, under our account) | Each download's network address only |
| The Website [to be confirmed] | Cloudflare Pages (Cloudflare, Inc.) | Visitors' network addresses and form entries (no analytics or advertising tools at launch) |
5. How we tell you about changes
5.1 New subprocessors. We update this page at least [30] days before a new subprocessor starts to process personal data under the DPA. [to be confirmed]
5.2 E-mail notice. When we update this page for a new subprocessor, we also e-mail every Customer with an active License, at the address on its License Key (or its named contact if it signed the DPA); anyone else can ask at [email protected] to be e-mailed. Objections: DPA sections 8.3 and 8.4. [to be confirmed]
5.3 Other changes. For section 2 providers that process only License Data, and for sections 3 and 4, we update this page before a new provider receives personal data.
5.4 Urgent replacements. If we must replace a provider at short notice (for example it stops its service, or for security), we may give shorter notice and will tell you as soon as we can.
5.5 Section 5.1 covers only subprocessors we engage ourselves; our providers announce theirs under their own terms.
6. Where data is processed
We are based in the United States and sell only to businesses located in the United States. Our service providers may process data outside the United States; each one's location is in sections 2 and 3. We keep no EU / UK-specific transfer terms at this time.
7. History of this list
| Date | Change |
|---|---|
| not yet in effect | First version |
8. Contact
Questions about this list: Point of the Mountain Software LLC, [email protected].