Company information and subprocessors
Last updated: · Last reviewed:
Last updated: 31 August 2026
1. Company information
This website and the Lydmera software service are operated by:
Lydmera Limited Company number: 78292 (Guernsey Registry reference CMP78292) Registered office: La Porte, La Grande Lande, St Saviour, GY7 9YZ, Guernsey Jurisdiction of incorporation: Guernsey
The registered office is an address for formal correspondence. Product, sales and support enquiries should use the Contact page.
Contact channels
| Purpose | Contact |
|---|---|
| Legal notices and intellectual-property matters | legal@lydmera.com |
| Privacy questions and data-protection rights | privacy@lydmera.com |
| Responsible security disclosure | security@lydmera.com |
| Product, sales, support and partnerships | Contact page |
| Paddle transaction, cancellation or refund support | Paddle buyer portal or the support link in the Paddle transaction email |
2. Intellectual property
Lydmera Limited uses LYDMERA™ and the Lydmera logo as its trademarks. The ™ symbol does not assert that a mark is registered. Lydmera does not currently claim a registered trademark or use the registered-trademark symbol.
The software, website, calculation code, documentation, report templates and branding are protected by applicable intellectual-property laws.
3. Commercial and regulatory position
Lydmera provides software, not engineering consultancy or professional certification. See the Terms of Service and Engineering Disclaimer.
Paddle acts as the authorised reseller and Merchant of Record for self-service transactions. Paddle, not Lydmera, is the seller for the payment transaction and administers payment, applicable transaction taxes, cancellation and refunds under Paddle’s buyer terms. Paddle is listed separately below because it is an independent controller for that transaction activity, not a Lydmera subprocessor.
This Legal Notice does not claim that Lydmera holds a professional-engineering or security certification or a regulated professional authorisation. A generated report may identify the exact method and edition applied to that calculation, but that does not amount to blanket product certification.
4. Data-protection documents
The following documents apply as relevant:
- Privacy Notice — Lydmera’s controller and processor roles and individuals’ rights;
- Cookie and Device-Storage Policy — storage used on the site and controls;
- Data Processing Addendum — Customer-controlled personal data processed by Lydmera; and
- this subprocessor register — providers used for Customer Personal Data.
Lydmera Limited maintains its annual registration with the Office of the Data Protection Authority in Guernsey. The Privacy Notice identifies Lydmera’s direct privacy contact and will be updated with the corporate details of any separately appointed UK or EEA representative.
5. Subprocessors used by Lydmera as processor
Where Lydmera processes personal data in Customer Content on a Customer’s instructions, the following providers may act as subprocessors.
| Provider legal entity | Service and purpose | Personal-data categories | Processing/storage locations | Transfer safeguards |
|---|---|---|---|---|
| Vercel Inc. | Application hosting, edge delivery and server/request handling | Customer Content transmitted through hosted application routes; ordinary request and technical data | United States and other provider/subprocessor locations | Vercel DPA, incorporated transfer clauses and jurisdiction-specific terms |
| Supabase Pte. Ltd | Managed database, authentication and file/object storage | Account, authentication, project and uploaded-file data | Production project region and other locations used by authorised subprocessors | Supabase DPA, incorporated SCCs and applicable UK or other addenda |
| Anthropic, PBC | Commercial API used for selected document/image extraction and draft narrative | Content deliberately sent to an AI feature, prompts and returned values/text | United States and other locations permitted by the commercial DPA | Anthropic commercial DPA and applicable transfer clauses |
| Plus Five Five, Inc. (Resend) | Transactional messages relating to Customer use, including contact/support delivery where implemented | Recipient address, message/template content and delivery metadata | United States and authorised subprocessor locations | Resend DPA and incorporated transfer clauses |
Climate lookup is performed server-to-server using only the project coordinates and technical query parameters needed to return weather/design data. Lydmera does not intentionally send the climate service the user’s name, email address, Account identifier, client name or project narrative. Lydmera maintains that separation; if a climate provider begins receiving identifiable Customer Content, it will be added to this register before that change is enabled.
Lydmera does not use a separate customer-support platform, analytics service, session-replay service or third-party error-reporting SDK at launch. Ordinary hosting and application diagnostics remain within the providers identified above.
6. Processors for Lydmera’s controller activities
Providers may also process personal data for which Lydmera is controller, such as Account, authentication, security, transaction-reconciliation, contact and support data. The same provider may appear in sections 5 and 6 for different data and roles.
| Provider legal entity | Controller activity | Typical personal data | Processing/storage locations and safeguards |
|---|---|---|---|
| Vercel Inc. | Public/application hosting, edge delivery and ordinary request handling | IP/request/device information and data submitted to hosted routes | United States and other provider/subprocessor locations under Vercel’s DPA and transfer terms |
| Supabase Pte. Ltd | Account database, authentication and file/object storage | Account, session, security and service-administration data | Production project region and authorised subprocessor locations under Supabase’s DPA and transfer terms |
| Plus Five Five, Inc. (Resend) | Account verification, essential service email, contact-form delivery and support administration | Name, email, correspondence, template content and delivery metadata | United States and authorised subprocessor locations under Resend’s DPA and transfer terms |
These providers are not automatically Customer’s subprocessors for every activity. Section 5 and the DPA apply only when they process Customer Personal Data on Customer’s behalf.
7. Independent controllers and other recipients
These organisations are not subprocessors for the activities stated below.
| Recipient | Role | Purpose/data shared | Governing notice |
|---|---|---|---|
| The Paddle entity identified for the buyer’s location | Independent controller and authorised reseller/Merchant of Record | Buyer identity/contact details, billing address, transaction, subscription, tax, fraud, support and reconciliation data | Paddle Buyer Terms, Refund Policy and Privacy Policy |
| Professional advisers, courts, regulators or authorities | Independent controller or other lawful recipient, depending on the matter | Only information necessary for advice, claims, audit or a lawful request | Recipient’s notice and applicable law |
Paddle is therefore not included in the subprocessor table for buyer transactions. If Paddle separately processes data solely on Lydmera’s instructions for a distinct service, that separate role will be identified before the processing begins.
8. Changes to subprocessors
The Data Processing Addendum gives Customer general written authorisation for the listed subprocessors. For a proposed new or replacement subprocessor that will process Customer Personal Data, Lydmera will:
- update this register;
- give affected Customer administrators reasonable advance notice and, for a material non-emergency change, aim to give at least 30 days’ notice;
- provide enough information for a reasonable data-protection objection; and
- require the new subprocessor by written contract to protect the data to a standard equivalent to the applicable DPA obligations.
A Customer may object during the notice period on reasonable, documented data-protection grounds. The resolution process and possible termination of the affected Service are in the DPA. An urgent replacement required to address a security incident, provider failure or legal requirement may occur sooner, with notice as soon as reasonably practicable.
Lydmera maintains the affected administrator contact list, change record and evidence of notices issued under this section.
9. Requests and complaints
This register is maintained publicly so a buyer can understand the main data flow without requesting a separate copy. A Customer may request additional transfer or security information at privacy@lydmera.com, subject to reasonable confidentiality and security restrictions.
Data-protection complaints may be made to the Office of the Data Protection Authority in Guernsey and, where the corresponding law applies, the UK Information Commissioner’s Office or an EEA supervisory authority. See the Privacy Notice for details.