Subprocessors
Superbloo uses the third-party services below to operate the platform. Each has been reviewed, is bound by a data-processing agreement, and receives only the data it needs for the purpose listed. We do not sell personal information to any of them.
01Infrastructure
These process data for every account, because they are what the product runs on.
| Vendor | Purpose | Data processed | Hosting |
|---|---|---|---|
| Cloudflare | Object storage (R2) for uploads, generated media, and exports; Workers for realtime collaboration and the media gateway; CDN; cookieless Web Analytics on marketing pages | Customer Content, realtime editing events, request metadata; aggregate page-view counts for marketing pages (no cookies, no device storage) | Global (Cloudflare network) |
| Fly.io | API and background-job hosting | Everything the API processes: account records, workspace and project metadata, timelines, credit ledger, request metadata | United States (Ashburn, Virginia — iad) |
| Modal | GPU rendering and footage analysis (alternate provider to RunPod) | Timeline data and source media for the duration of a render or analysis job | United States |
| Neon | Application database (Postgres) | Account records, workspace and project metadata, timelines, credit ledger | United States (AWS us-east-1) |
| RunPod | GPU rendering and footage analysis (transcription, scene and face indexing) | Timeline data and source media for the duration of a render or analysis job | Global (RunPod serverless network) |
| Vercel | Web application hosting and edge network | Request metadata, IP address | Global (edge) |
02Business operations
Billing, email, logs and the measurement we use to keep the product working. Analytics and session replay follow your choice as described in our Cookie Notice (web) and under Settings → Privacy (desktop). The other processors are necessary to provide the Services.
| Vendor | Purpose | Data processed | Hosting |
|---|---|---|---|
| Axiom | Operational log storage and alerting for the API and workers | Request and job logs: request ids, account and workspace ids, timings, error messages with URLs and content removed | United States |
| DataFast | Website traffic, visitor-journey and revenue attribution analytics | Page views and referrer on marketing and app pages (never on review-link or invitation pages), a cookie-based visitor and session id, an opaque user id once you sign in, and the payment amount, currency and processor customer id of subscription payments reported from our servers. Not your name or email. The tracker loads only after you allow analytics (web, EU/EEA/UK/CH and unknown regions) or by default elsewhere | Global (DataFast; hosting location to be confirmed with the vendor) |
| Dodo Payments | Subscription billing and payment processing | Billing contact, plan, transaction records. Card data is handled by the processor; we never receive it | Global |
| PostHog | Product analytics, session replay, feature flags | Account-linked usage events, page/screen views (review and invitation link tokens are removed from URLs), device class and, only with your consent (web) or when switched on (desktop), session replay with all text in the app and every input masked | European Union (Frankfurt) |
| Resend | Transactional email delivery | Email address, message content | United States |
| Sentry | Error and crash reporting | Stack traces, scrubbed error messages, app version, OS and device class, and, from the desktop application, an anonymous install ID and your opaque user id (never your email) | European Union |
03AI model providers
Engaged only for the generations you run, using the model you or your workspace admin selected. Our terms with each provider prohibit them from training their foundation models on your inputs or outputs by default, as described in section 05 of our Privacy Policy.
| Vendor | Purpose | Data processed | Hosting |
|---|---|---|---|
| Anthropic | Text generation and agent reasoning (Claude models) | Prompts and conversation context for the selected model | United States |
| AssemblyAI | Speech-to-text transcription (fallback during provider outages) | Audio you submit for transcription | United States |
| ElevenLabs | Text-to-speech, dubbing, music, sound effects, transcription | Prompts, scripts, reference audio | United States |
| fal.ai | Hosted inference for image, video, and 3D models | Prompts and reference assets for the selected model | United States |
| Firecrawl | URL scraping for the product-ad importer | The public URL you submit | United States |
| Google (Gemini API, Vertex AI) | Image, video, and multimodal generation; footage understanding | Prompts and reference assets for the selected model | United States |
| KIE | Hosted inference routing for video models | Prompts and reference assets for the selected model | United States |
| OpenAI | Text and image generation, embeddings | Prompts and reference assets for the selected model | United States |
| OpenRouter | Model routing for text and agent requests | Prompts and conversation context for the selected model. Requests are sent with provider data collection denied, so only upstream providers that do not retain or train on prompts are eligible (OPENROUTER_DATA_COLLECTION) | United States |
04Content libraries
Search-only integrations. These receive the query text (and, where previews load directly in your browser, your IP address) and nothing that identifies your account or workspace.
| Vendor | Purpose | Data processed | Hosting |
|---|---|---|---|
| Brandfetch | Brand and logo search for the Logos tab | Search terms, the brand domain you pick, and your IP address (logo previews load in your browser). No account data | Global (CDN) |
| Iconify | Icon library lookup | Search terms only. No account data | Global (CDN) |
| Pexels | Stock video and photo search for B-roll | Search terms only. No account data | Global (CDN) |
05Changes to this list
We update this page when we add or remove a subprocessor. If you have a signed Data Processing Addendum with us and would like advance notice of changes, email privacy@superbloo.com and we will add you to the notification list.
06Questions
For due-diligence questions, our Security page covers how data is protected in transit and at rest. Anything else, contact privacy@superbloo.com.