Scoped Standard Contractual Clauses (SCCs)

1. Introduction

Aletheia by Lonia AI adopts the European Commission Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (Controller-to-Processor), for the specific data transit path involving Lonia-mediated Enhanced AI descriptions for Personal and Family tier consumer users. This statement scopes that adoption precisely: it applies to that path and no other.

2. Scope of Application

Covered path. Personal and Family tier Enhanced AI, which Lonia pays for using a Lonia-controlled OpenRouter account. The image and the description request and response transit from the user's browser to a Lonia Cloudflare Worker, then to OpenRouter (United States hosted), and back.

Not covered by these SCCs:

• On-device (MobileVLM) processing, where no cross-border transfer occurs because the processing happens entirely in the user's browser.
• Professional bring-your-own-key Enhanced AI, which is user-invoked with the user's own API key and runs browser-direct to the AI provider. Aletheia does not intermediate it, so no cross-border transfer occurs through Lonia on this path.
• Enterprise bring-your-own-key Enhanced AI is intermediated by Lonia's Enterprise Worker: the institution's enrolled key is used server-side to call the AI provider on the institution's behalf, so the request content transits Lonia's Cloudflare and Supabase infrastructure. That Lonia-mediated transit is not covered by these consumer Enhanced AI clauses; it is covered instead by the Standard Contractual Clauses for Lonia's Cloudflare and Supabase infrastructure referenced in the DPA at /legal/dpa, which govern all Lonia-mediated data flows.
• Institutional data at rest, which is United States hosted under the Standard Contractual Clauses referenced in the DPA at /legal/dpa. Any future migration of the Supabase primary data store to an EU region would remove that transfer for data at rest, but no such migration is currently planned or scheduled.

3. Roles

• Data Exporter: Aletheia by Lonia AI, in its role as data controller for consumer users' processing.
• Data Importer: OpenRouter, Inc. (United States based), acting as processor for AI provider API access.

4. Nature and Purpose of Transfer

5. Supplementary Measures (post-Schrems II)

• TLS 1.3 encryption in transit for all requests to OpenRouter.
• Image content is not logged in Lonia's Cloudflare Worker.
• The image is not persisted server-side beyond the synchronous request and response cycle.
• OpenRouter's own security posture, described in its privacy policy and security documentation, provides additional supplementary measures.
• Aletheia commits to reassess this scoped SCC when United States surveillance law materially changes, when OpenRouter's security posture changes, or annually at minimum.

6. Enforcement and Remedies

Data subjects have the rights provided in Section III of the Standard Contractual Clauses, including third-party beneficiary rights and the right to lodge a complaint with a competent supervisory authority. Questions or requests can be sent to legal@lonia.ai.

7. Duration

These Standard Contractual Clauses are effective from July 15, 2026 and remain in force until the first of the following occurs:

• the Supabase primary data store is migrated to an EU region in the future and the OpenRouter path is either rearchitected to originate from within the EU or the Personal and Family Enhanced AI feature is discontinued; or
• OpenRouter obtains EU adequacy status; or
• five years from the publication date.

8. Review Cadence

This statement is reviewed annually, or on material change, whichever comes first. Material changes include a change in United States surveillance law or CJEU jurisprudence, a change in OpenRouter's security or data handling posture, and any future migration of the Supabase primary data store to an EU region. On each review this page and the tagged PDF are regenerated together from the same source.

Related documents

• Scoped Standard Contractual Clauses (tagged PDF)
• Transfer Impact Assessment (TIA)
• Data Protection Impact Assessment (DPIA)
• Data Processing Agreement (DPA) template
• Sub-processor list
• Privacy Policy

This statement scopes Aletheia's adoption of the Standard Contractual Clauses for the covered transfer. It is not legal advice and does not replace the executed clauses themselves.