Legal
Sub-processors
Current sub-processors
These providers may process personal data to help us provide Brioloom. Each is bound by a data processing agreement, and transfers outside the EEA are protected as described in our DPA.
| Provider | What they do for Brioloom | Data location |
|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage, sign-in emails | United States |
| Anthropic, PBC | AI writing: post text and captions, and the colour palette pick (Claude) | United States |
| Google Cloud (Google LLC) | AI processing for images and website reading; cloud hosting | United States |
| Vercel, Inc. | Hosting of the website and web dashboard | United States and global edge network |
| Inngest, Inc. | Running and scheduling background jobs | United States |
| Cloudflare, Inc. | Reading and capturing public websites for brand analysis; bot checks on website forms (Turnstile); DNS; email forwarding | Global network, United States |
| Stripe (Stripe Payments Europe, Ltd. and Stripe, Inc.) | Payments, subscriptions, invoices, fraud prevention | Ireland, United States |
| bundle.social (BUNDLE sp. z o.o.) | Connecting social accounts, publishing posts, collecting post statistics | Poland (EEA) |
| Apple Inc. | Push notifications to iPhone and iPad (APNs) | United States |
| Google LLC (Firebase Cloud Messaging, Firebase App Check) | Push notifications to Android devices; checking that free-preview requests come from the real Brioloom app | United States |
| Resend (Plus Five Five, Inc.) | Sending sign-in and account emails, and free preview emails | United States |
| Sentry (Functional Software, Inc.) | Error reports from the apps, website and background jobs, so we can fix problems | European Union (Germany) |
| Telegram (Telegram Messenger Inc.) | Alerts to our founder when someone asks for a coffee on our laptop QR page (first name, drink, Instagram name if given). Not used for customer data | Netherlands (EU) for our account; see Telegram's privacy policy |
| PostHog, Inc. | Website analytics, only for visitors who allow it in the cookie banner; anonymous visit and tap counts on our QR pages | European Union (Germany) |
The social platforms you connect (such as Meta and TikTok) are not our sub-processors: you choose to publish to them and they handle data under their own terms.
Changes to this list
We give at least 30 days' notice of new sub-processors by email to account owners and on this page. To object, or to ask for a copy of a sub-processor's safeguards, write to privacy@brioloom.com.