Legal
Subprocessors
These providers help Loreto Media LLC operate, secure, support, and deliver Loreto Sites. A provider receives Customer Data only when its service is needed for the Services or a Customer-requested feature.
Last updated: August 17, 2026
Current provider list
| Provider | Service | Data used |
|---|---|---|
| Google LLC — Firebase and Google Cloud | Authentication, database, file storage, security, hosting support, logs, and diagnostics | Account records, Customer Content, form data, security events, and service logs |
| Vercel Inc. | Application hosting, deployments, edge delivery, Analytics, and Speed Insights | Requests, public-site events, performance data, logs, and deployment data |
| Cloudflare, Inc. | DNS, edge delivery, certificates, security, and deployment support when enabled | Request, domain, routing, security, and deployment data |
| Stripe, Inc. | Checkout, subscriptions, invoices, payment status, tax details, and fraud controls | Billing contact, payment method details entered in Stripe, subscription data, and billing metadata |
| Twilio SendGrid | Service, support, import, and Customer Site form email | Recipient and sender details, message content, delivery events, and form responses when emailed |
| Firecrawl | Website crawling, document extraction, and import recovery when enabled | Public source URLs, page content, documents, and import instructions |
| OpenAI, xAI/Grok, and Google Gemini | Configured automated review, drafting, classification, support, and extraction features | Only the text, images, documents, or support context needed for the requested feature |
Processing limits
Loreto selects providers for the Services, requires them to protect information under their contracts, and sends them only the data needed for their stated function. Loreto does not sell Customer Data, use it for cross-context behavioral advertising, or use it to train a general-purpose model.
Some providers process or store information in the United States or other countries where they operate. Their own privacy notices and service terms describe their systems and retention practices. The Data Processing Addendum governs Loreto’s instructions, security duties, deletion, rights assistance, and provider changes. Deletion from a provider’s logs or backups may follow that provider’s normal cycle.
Provider changes
Loreto may add, remove, or replace a provider as the Services change. Loreto will update this page before or when a material change takes effect, unless a written agreement requires a different notice. A Customer with a Data Processing Addendum may raise a written, reasonable data-protection objection within fifteen days after notice. Loreto may offer a suitable alternative, stop the affected feature, or end the affected Services if the parties cannot resolve the objection.
Contact
Questions about providers may be sent to support@loretosites.com or Loreto Media LLC, 501 S Midvale Blvd, Madison, WI 53711, or by phone at (608) 285-2027.
Effective date: August 17, 2026. Subprocessors version: 2026-08-17.