Subprocessors

Last Updated: June 16, 2026

Supload LLC uses the following third-party subprocessors to deliver the Supload service. Each subprocessor processes data only as necessary to provide the specific function described below.

We will update this page before engaging any new subprocessor and provide at least 30 days’ notice to Enterprise customers. Enterprise customers receive subprocessor change notifications automatically at the account administrator’s email address. All other customers may subscribe to notifications by emailing privacy@sup-load.com with the subject line “Subprocessor Notifications.”

Enterprise customers who object to a new subprocessor may contact legal@sup-load.com within the 30-day notice period. If the objection cannot be resolved, the Enterprise customer may terminate their agreement in accordance with their Enterprise plan terms.

Current Subprocessors

Infrastructure

Authentication

Cloud Storage

Payment Processing

Communications

Planned Subprocessors

None at this time. This page will be updated before any new subprocessor is engaged.

What Supload’s Servers Never Touch

Your photos and videos. Media files go directly from your device to your own cloud storage (Google Drive, Dropbox, or Microsoft OneDrive). They are never routed through, stored on, or processed by Supload’s servers.

Payment card information. Stripe processes all subscription billing (Pro and Enterprise) through a secure web checkout. Apple does not process Supload subscription payments. Supload receives subscription status and billing email only — never card numbers, bank account details, or payment credentials.

Authentication passwords. You sign in through Google, Apple, or your organization’s SSO. Supload never receives, stores, or processes your password. We receive only an authentication token and basic profile information (email, display name).

Cloud storage credentials. Your Google Drive, Dropbox, and OneDrive passwords are never shared with Supload. Cloud OAuth tokens are stored only in your device’s iOS Keychain (hardware-encrypted, accessible after first unlock, not synchronized to other devices) and are used solely to maintain your cloud connection. They are never stored on Supload’s servers.

Advertising data. We do not use advertising subprocessors, ad networks, or data brokers.

Analytics with PII. Usage analytics are stripped of personally identifying information before storage.

AI or ML training data. We do not use subprocessors for AI model training, machine learning, or automated profiling of user data.

Data Processing Agreements

Supload relies upon the standard data processing terms published by each subprocessor, including Google’s Data Processing Terms, Apple’s Data Processing Addendum, Supabase’s Data Processing Agreement, Cloudflare’s Data Processing Addendum, Dropbox’s Data Processing Agreement, Microsoft’s Data Protection Addendum, Stripe’s Data Processing Agreement, and Resend’s Data Processing Agreement. These standard terms include obligations for data protection, security, confidentiality, and compliance with applicable data protection laws including GDPR, CCPA, and other US state privacy laws.

For Enterprise customers who require a Data Processing Agreement between their organization and Supload LLC, a standard DPA will be available upon request at legal@sup-load.com.

Data Retention by Subprocessor

For complete retention details, see our Privacy Policy, Section 7.

International Data Transfers

All subprocessors are based in the United States or operate global infrastructure. For users in the European Economic Area (EEA), data transfers to the United States are governed by Standard Contractual Clauses (SCCs) and the data processing agreements maintained with each subprocessor. For details, see our Privacy Policy, Section 13.

Changes to This List

Questions

Contact privacy@sup-load.com with any questions about our subprocessors or data processing practices.