Subprocessors and Third-Party Services

SUPLOAD LLC

Version 2.4.1 | Last Updated: October 23, 2026

This page has two parts. Subprocessors are vendors Supload LLC engages to process personal data on Supload's behalf to deliver the service. Third-party services you connect are your own accounts (sign-in, cloud storage, and the App Store) that you use with Supload. Those providers act as your own service providers under your agreements with them, not as Supload's subprocessors, and your media goes to them directly from your device. Apple, which bills Pro purchased in the App as merchant of record, is likewise your provider and an independent controller of that purchase, not Supload's subprocessor.

We update this page before adding or replacing a subprocessor and give Enterprise administrators at least 30 days' notice by email to the administrator address on file; anyone else can join the notice list by emailing [email protected] with the subject line "Subprocessor Notifications." If we must replace a subprocessor urgently to keep the service secure or available, we will give as much notice as we can and explain why.

Enterprise customers who object to a new or replacement subprocessor may contact [email protected] within the 30-day notice period. If the objection cannot be resolved, the Enterprise customer may terminate the affected services on written notice and receive a pro-rated refund of prepaid fees for the unused term, as our Data Processing Agreement provides.

Part 1: Supload's Subprocessors

These vendors process personal data on Supload's behalf.

Planned subprocessors: none at this time. This page will be updated before any new subprocessor is engaged. The website waitlist form (the one form the site has today) adds no new vendor: entries are stored on Supabase, and the Turnstile check on it is Cloudflare's (Part 1).

Part 2: Third-Party Services You Connect

When you sign in or link cloud storage, you connect your own account with these providers. They process your data under their own terms and privacy policies as your providers, not on Supload's behalf. Supload's role is to send your media from your device directly to the account you choose.

Sign-In (Identity Providers)

Supload never receives or stores a password for your account. For Enterprise customers using directory sync (SCIM 2.0), the organization's identity provider also sends Supload user provisioning data (email address, display name, given and family name, an external identifier, active status, and a role mapping) to manage organization membership; provisioning is limited to email domains the organization has verified, and deprovisioning disables the membership and releases the seat, and deletes nothing.

Each provider's handling of your sign-in data is governed by its own privacy policy: the Google Privacy Policy, the Apple Privacy Policy, and the Microsoft Privacy Statement.

Cloud Storage (Your Upload Destination)

Your use of these providers is governed by your own agreement with them: the Google Terms of Service, the Dropbox Terms of Service, and the Microsoft Services Agreement (or your organization's agreement for work and school accounts). See our Terms of Service, Section 5.3.

Platform Services on Your Device

What Supload's Servers Never Hold

Your photos and videos. Media files go directly from your device to your own cloud storage (Google Drive, Dropbox, or Microsoft OneDrive). They are never routed through, stored on, or processed by Supload's servers.

Payment card information. Apple processes payment for Pro purchased inside the App, as merchant of record. From Apple we receive a subscription record and subscription status, and no payment-method details at all. Stripe processes payment for Pro purchased on our website and for all Enterprise subscriptions through a secure web checkout, and shares subscription status, billing email, and limited payment-method metadata with us; for card payments Stripe's notice names the card brand and last four digits, which we remove before the record is stored. Stripe's checkout offers cards and other payment methods, such as digital wallets and pay-over-time options, and processes all of those directly; if you pay with a third-party payment method, its provider receives your details under its own terms. Supload never stores full card or bank account numbers, wallet credentials, or other payment credentials from either.

Authentication passwords. You sign in through Google, Apple, or your organization's SSO. Supload never receives, stores, or processes your password. We receive only an authentication token and basic profile information (email, display name).

Cloud storage credentials. Your Google Drive, Dropbox, and OneDrive passwords are never shared with Supload. Cloud OAuth tokens are stored only in your device's iOS Keychain (hardware-encrypted, accessible after first unlock, not synchronized to other devices, and not migrated to a new device) and are used solely to maintain your cloud connection. They are never stored on Supload's servers.

Advertising data. We do not use advertising subprocessors, ad networks, or data brokers.

Analytics with personal details. Usage analytics are opt-in, first-party, and stripped of personal details before storage. They are recorded with your account identifier so we can delete them when you delete your account.

AI or ML training data. We do not use your content or personal data to train AI or machine learning models, and we do not permit our service providers to do so on our behalf. The App does not send your data to any third-party AI service, and we do not use subprocessors for automated profiling of user data.

Data Processing Agreements

Supload maintains written data processing terms with each subprocessor listed in Part 1: the Supabase Data Processing Addendum, the Cloudflare Data Processing Addendum, the Stripe Data Processing Agreement, the Resend Data Processing Addendum, and the Cloud Data Processing Addendum (Google's addendum covering Google Workspace, which applies to our Workspace account automatically). These terms require each subprocessor to keep personal data confidential, protect it with appropriate security measures, process it on Supload's instructions to provide its service, comply with applicable data protection laws, including the CCPA, and not sell it. We have reviewed them and confirm that each subprocessor protects your data at least as well as our Privacy Policy describes. Some vendors, such as Stripe on its own checkout pages, also process certain data as independent businesses under their own privacy policies (for example, for fraud prevention); that processing is described in their policies.

The sign-in and cloud storage providers you connect (Google, Apple, Microsoft, Dropbox) process your data under their own consumer or organizational terms with you, so no Supload subprocessor DPA applies to that processing.

Supload's Data Processing Agreement forms part of every Enterprise customer's agreement with Supload LLC from its first day of Enterprise use, including trials; a signed copy is available on request at [email protected].

Data Retention

Deleted data may remain in our hosting provider's backups for up to about seven days before those backups age out; we do not use backups to restore individual accounts. For complete retention details, see our Privacy Policy, Section 7.

International Data Transfers

Supload LLC is based in the United States, Supload is offered in the United States, and its subprocessors are based in the United States or operate global infrastructure. If you use our website from outside the United States, you provide any information directly to Supload in the United States. The App is not offered in the EEA or the UK; see our Privacy Policy, Section 8.3. Our subprocessors commit to Standard Contractual Clauses and equivalent safeguards in their data processing terms where their own transfers require them. Photos and videos transfer directly from your device to your own cloud provider. For details, see our Privacy Policy, Section 13.

Questions

Contact [email protected] with any questions about our subprocessors or data processing practices.

Changes to This List