Sub-processors
Version 1.0 · 5 August 2026
This page lists the third parties we engage to help deliver LumiaChatFlow, and what each one does. It supports the general authorization for sub-processors in our Data Processing Agreement.
Current sub-processors
| Sub-processor | Entity / location | What it does | Data involved |
|---|---|---|---|
| Google Cloud Platform | Google Cloud EMEA Ltd. / Google Ireland Ltd. — region europe-west1 (Belgium) | Application hosting, Firestore database, object storage, Cloud Tasks, Cloud KMS encryption keys | All customer account data, workspace and agent configuration, conversation records |
| Firebase (Google) | Same as above | Authentication, session management, web hosting | Account identifiers, authentication state |
| Google — Gemini API and File Search Stores | Google LLC / Google Ireland Ltd. — location global (no regional guarantee) | AI model inference, and indexing of your content for retrieval (RAG) | Content you index — crawled pages and uploaded files — and the text of conversations sent for a response |
Not a sub-processor: PayPro Global
PayPro Global Inc. (225 The East Mall, Suite 1117, Toronto, ON, M9B 0A9, Canada) sells LumiaChatFlow paid plans as our authorized reseller and Merchant of Record.
PayPro Global is an independent data controller for order, billing, and payment data — not our processor and not a sub-processor. It decides how it handles that data, and its own privacy policy governs it. We receive limited purchaser details from PayPro Global in order to provision and support your account, and we act as a separate controller for what we receive.
Canada holds an EU adequacy decision for commercial organizations governed by PIPEDA.
Model providers
Where you select a model other than Gemini, the request is served through Google Cloud Vertex AI Model Garden rather than by us contracting directly with that model's developer. The models offered change over time; the current selection is shown in the product when you configure an agent.
We do not train or fine-tune models. Our AI providers' paid-tier terms commit them not to use the prompts, files, or responses we send in order to improve their models.
Changes to this list
We will update this page before adding a new sub-processor that has material access to customer personal data. We notify all customers covered by our DPA (accepted with the Terms of Service — no signature involved) directly, at least 30 days before the change takes effect. You may object on reasonable data-protection grounds within that period; if we cannot resolve your objection, you may terminate the affected part of the service without penalty for the remainder of the paid term.