Sub-processor List

Loops Sub-processor List

Effective Date: September 30, 2026

This Sub-processor List identifies third-party service providers engaged by LYT Soft Inc. ("Loops") to process Customer Personal Data in connection with the Loops platform and Services.

Loops uses these sub-processors to provide infrastructure, functionality, analytics, communications, payments, and AI-powered features.

This list may be updated from time to time in accordance with the Loops Data Processing Addendum and applicable Agreement terms.

1. Infrastructure & Hosting

Hetzner

• Purpose: Cloud hosting and infrastructure services
• Data Processed: Application data, customer account data, review data, system logs
• Location: Germany (EU)

Supabase

• Purpose: Database hosting, authentication, and storage services
• Data Processed: Customer account data, business data, application data, review content
• Location: United States

2. Artificial Intelligence Providers

OpenAI

• Purpose: AI processing for summaries, classification, and response generation
• Data Processed: Review content, prompts, and related metadata submitted via API
• Location: United States

3. Review Data Aggregation

Zembra

• Purpose: Review aggregation and enrichment services
• Data Processed: Business identifiers, review content, platform metadata
• Location: United States

4. Third-Party Platform Integrations

Google

• Purpose: Authentication (OAuth) and access to business/review data APIs
• Data Processed: Profile data, authentication tokens, business and review data
• Location: United States

5. Payment Processing

Stripe

• Purpose: Payment processing, billing, and subscription management
• Data Processed: Billing contact details, payment metadata, subscription information
• Location: United States

(Note: Full card details are processed directly by Stripe and are not stored by Loops.)

6. Communications & Email

Loops.so (Email Infrastructure Provider)

• Purpose: Transactional and marketing email delivery
• Data Processed: Email address, name, communication metadata, email engagement data
• Location: United States

7. Website Analytics

PostHog (PostHog Inc.)

• Purpose: Analytics on the Loops marketing website (visits, pages viewed, how visitors arrive)
• Data Processed: Website visitor data only, not Customer Personal Data: pages visited, referrer, device and browser information, approximate location derived from IP address, a pseudonymous visitor identifier (a persistent cookie-based identifier if the visitor accepts cookies, otherwise a temporary identifier that changes daily), and the visitor's cookie choice
• Location: United States

8. Authentication & Platform Access (Indirect via Providers)

Some authentication and identity services are provided through integrated third-party systems (e.g., Google OAuth).

• Purpose: User authentication and login management
• Data Processed: Email, profile information, authentication tokens
• Location: United States / Global

9. Changes to This List

Loops may update this Sub-processor List to reflect:

• Addition of new vendors
• Replacement of existing vendors
• Changes in service scope or processing activities

Where required by law or contract, Loops will provide advance notice of material changes and allow Customers to object on reasonable data protection grounds.

Continued use of the Services after updates constitutes acceptance of the revised Sub-processor List.

10. Customer Acknowledgment

By using the Services, Customer acknowledges and agrees that:

• Loops engages the sub-processors listed above;
• These sub-processors may process Customer Personal Data as necessary to provide the Services;
• Customer authorizes Loops to engage third-party service providers and sub-processors to process Personal Data in connection with providing the Services.
  • Current sub-processors used by Loops are identified in the Loops Sub-processor List.
  • Customer acknowledges that many sub-processors provide services under their own standard commercial terms, privacy policies, and data processing agreements, and that Loops does not control the technical, operational, or security practices of independent third-party providers.