Legal
Sub-processors
Last updated: April 27, 2026
SourceLoop engages a small set of third-party service providers to help operate the SourceLoop application, the tracking snippet, and our marketing website. These sub-processors are vetted for security, bound by data-protection terms with us, and used only to the extent described below. This page is incorporated by reference into our Data Processing Addendum.
We will provide notice of changes to this list (additions or replacements) at least thirty (30) days before the change takes effect, by updating this page and, where the change is material, by email to your Account contact. Customers under a paid subscription have the right to object to a new sub-processor as described in the DPA.
Application sub-processors
Used to operate app.sourceloop.ai, the APIs, and the
snippet's data-collection endpoints. These sub-processors process
Customer Data and End User Data.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Postgres database, authentication, and file storage for the SourceLoop application | All Customer Data and End User Data processed by the application | United States, European Union |
| Cloudflare | CDN, edge delivery, DDoS protection, WAF, and DNS for the application and the snippet | Network metadata, request logs, IP addresses | Global edge network |
| Polar.sh | Subscription billing, invoicing, and payment processing | Customer billing contact, billing address, payment-method tokens | European Union (Sweden), United States |
| Brevo | Transactional and product email delivery (account, billing, security alerts) | Customer email address, name, message content | European Union (France) |
| Sentry | Application error tracking and performance monitoring | Error stack traces, request metadata, anonymous user identifiers | United States |
| Vercel | Static asset hosting for the snippet bundle | Network metadata, request logs | Global edge network |
Marketing website sub-processors
Used to operate sourceloop.ai. These sub-processors do
not have access to End User Data collected through the snippet.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Cloudflare Pages | Hosting and edge delivery for sourceloop.ai | Network metadata, request logs, IP addresses | Global edge network |
| Sanity | Headless CMS for blog content | Blog content; no personal data of website visitors | United States, European Union |
| Tally | Contact form submissions | Name, email, company, role, message content submitted to the contact form | European Union |
| Cal.com | Demo and meeting bookings | Name, email, calendar metadata | United States, European Union |
| Wistia | Hosting and delivery of the product demo video | Anonymous viewer engagement metrics | United States |
Notification of changes
To receive proactive notice when this list changes, email hello@sourceloop.ai with the subject line "Subscribe to sub-processor updates" and your Account email. Notifications are sent at least thirty (30) days before a new sub-processor is engaged.
Contact
Questions about this list, or to formally object to a new sub-processor under the DPA, can be sent to hello@sourceloop.ai.
Paid Social
