Subprocessors and Third-Party Services

SUPLOAD LLC

Version 2.1.1 | Last Updated: July 31, 2026

This page has two parts. Subprocessors are vendors Supload LLC engages to process personal data on Supload’s behalf to deliver the service. Third-party services you connect are your own accounts (sign-in and cloud storage) that you link to Supload. Those providers act as your own service providers under your agreements with them, not as Supload’s subprocessors, and your media goes to them directly from your device.

We will update this page before engaging any new subprocessor and provide at least 30 days’ notice to Enterprise customers. We send subprocessor change notifications to the Enterprise account administrator’s email address on file. All other customers may subscribe to notifications by emailing [email protected] with the subject line “Subprocessor Notifications.”

Enterprise customers who object to a new subprocessor may contact [email protected] within the 30-day notice period. If the objection cannot be resolved, the Enterprise customer may terminate their agreement in accordance with their Enterprise plan terms.

Part 1: Supload’s Subprocessors

These four vendors process personal data on Supload’s behalf.

Planned subprocessors: none at this time. This page will be updated before any new subprocessor is engaged.

Part 2: Third-Party Services You Connect

When you sign in or link cloud storage, you connect your own account with these providers. They process your data under their own terms and privacy policies as your providers, not on Supload’s behalf. Supload’s role is to send your media from your device directly to the account you choose.

Sign-In (Identity Providers)

Supload never receives or stores a password for your account. For Enterprise customers using directory sync (SCIM 2.0), the organization’s identity provider also shares user provisioning data (email, display name, group membership, active status) with Supload to manage organization membership.

Each provider’s handling of your sign-in data is governed by its own privacy policy: the Google Privacy Policy, the Apple Privacy Policy, and the Microsoft Privacy Statement.

Cloud Storage (Your Upload Destination)

Your use of these providers is governed by your own agreement with them: the Google Terms of Service, the Dropbox Terms of Service, and the Microsoft Services Agreement (or your organization’s agreement for work and school accounts). See our Terms of Service, Section 5.3.

What Supload’s Servers Never Touch

Your photos and videos. Media files go directly from your device to your own cloud storage (Google Drive, Dropbox, or Microsoft OneDrive). They are never routed through, stored on, or processed by Supload’s servers.

Payment card information. Stripe processes all subscription billing (Pro and Enterprise) through a secure web checkout. Apple does not process Supload subscription payments. Supload receives subscription status, billing email, and limited payment-method metadata (for card payments, the card brand and last four digits) only, never full card numbers, bank account details, wallet credentials, or other payment credentials. Stripe supports cards and common wallets and pay-over-time options (such as Apple Pay, Link, Cash App Pay, Klarna, and Amazon Pay), and processes all of those directly.

Authentication passwords. You sign in through Google, Apple, or your organization’s SSO. Supload never receives, stores, or processes your password. We receive only an authentication token and basic profile information (email, display name).

Cloud storage credentials. Your Google Drive, Dropbox, and OneDrive passwords are never shared with Supload. Cloud OAuth tokens are stored only in your device’s iOS Keychain (hardware-encrypted, accessible after first unlock, not synchronized to other devices) and are used solely to maintain your cloud connection. They are never stored on Supload’s servers.

Advertising data. We do not use advertising subprocessors, ad networks, or data brokers.

Analytics with personal details. Usage analytics are opt-in, first-party, and stripped of personal details before storage. They are recorded with your account identifier so we can delete them when you delete your account.

AI or ML training data. We do not use your content or personal data to train AI or machine learning models, we do not permit our subprocessors to do so on our behalf, and we do not use subprocessors for automated profiling of user data.

Data Processing Agreements

Supload maintains data processing terms with each of its four subprocessors: the Supabase Data Processing Addendum, the Cloudflare Data Processing Addendum, the Stripe Data Processing Agreement, and the Resend Data Processing Addendum. These terms include obligations for data protection, security, confidentiality, and compliance with applicable data protection laws including GDPR, UK GDPR, CCPA, and other US state privacy laws.

The sign-in and cloud storage providers you connect (Google, Apple, Microsoft, Dropbox) process your data under their own consumer or organizational terms with you, so no Supload subprocessor DPA applies to that processing.

For Enterprise customers who require a Data Processing Agreement between their organization and Supload LLC, a standard DPA is available upon request at [email protected].

Data Retention

For complete retention details, see our Privacy Policy, Section 7.

International Data Transfers

Supload LLC is based in the United States, and its subprocessors are based in the United States or operate global infrastructure. When you use the App from the EEA, the UK, or Switzerland, you provide your account data directly to Supload in the United States. Our subprocessors commit to Standard Contractual Clauses and equivalent safeguards in their data processing agreements where their own transfers require them. Photos and videos transfer directly from your device to your own cloud provider. For details, see our Privacy Policy, Section 13.

Questions

Contact [email protected] with any questions about our subprocessors or data processing practices.