Last updated: May 15, 2026
Subprocessors
Supabrief uses the following third-party service providers (“subprocessors”) to deliver, secure, and improve the Service. Each is bound by a written data-processing contract and, where required for international transfers of EU/UK personal data, the 2021 EU Standard Contractual Clauses (Module 2) or the UK IDTA Addendum.
We will provide at least 30 days' notice before adding or replacing a subprocessor. To receive these notifications, email jeevan@flowlaunch.in with the subject “Subprocessor change notifications”.
Infrastructure subprocessors
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Supabase Inc. | Authenticated database (Postgres) and authentication | USA (AWS us-east-1) — verify per project | EU SCCs Module 2 + DPA |
| Vercel Inc. | Application hosting (Next.js serverless functions, edge network) | Global edge; primary region: USA | EU SCCs Module 2 + DPA |
| Razorpay Software Pvt Ltd | Payment processing, subscription management, GST invoicing | India | India-domiciled; no transfer issue |
AI processing subprocessors
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Anthropic, PBC (Claude API) | Generates briefs from your Input (primary provider for paid plans) | USA | EU SCCs + Anthropic's DPA. API inputs excluded from training per provider terms. |
| OpenAI, L.L.C. (GPT API) | Generates briefs from your Input (fallback for paid plans) | USA | EU SCCs + OpenAI's DPA. API inputs excluded from training per provider terms. |
| Google LLC (Gemini API) | Generates briefs from your Input (primary provider for free plan) | USA | EU SCCs + Google's DPA. API inputs excluded from training per provider terms. |
Each provider has been configured to exclude API inputs from training their models per the API terms in effect at the time of integration. Your Input is sent to these providers over TLS 1.2+ and is not used for any purpose beyond generating your requested Output.
Operational subprocessors
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Resend, Inc. {{IF_USING_RESEND}} | Transactional & marketing email delivery | USA | EU SCCs + DPA |
| Sentry / error monitoring {{IF_USING_SENTRY}} | Application error reporting | USA / EU (configurable) | EU SCCs + DPA |
Optional integrations (you control)
These are activated only if you connect them from Settings. Connecting an integration causes the data described to be processed by the named third party under their own privacy terms.
- Slack Technologies, LLC — if connected, we send brief output to the Slack channel you authorise. Governed by Slack's privacy policy.
- Atlassian Pty Ltd (Jira) — if connected, we fetch issue data you authorise. Governed by Atlassian's privacy policy.
- GitHub, Inc. — if connected via PAT, we read repository data you authorise. Governed by GitHub's privacy policy.
- Gong.io, Inc. — if connected, we fetch call/meeting data you authorise. Governed by Gong's privacy policy.
Questions or objections
If you object to a new subprocessor (GDPR Art 28(2) right), email jeevan@flowlaunch.in within 30 days of our notice. We will discuss alternatives or, if none are feasible, give you the option to terminate your subscription with a pro-rata refund of any prepaid unused fees.