Sub-processors
Effective 2026-09-23.
This page lists the third parties that process personal data for BaseLoom. It is Annex III to our Data Processing Addendum (https://app.baseloom.app/?view=legal&doc=dpa) and supports our Privacy Notice (https://app.baseloom.app/?view=legal&doc=privacy).
1. Providers that touch data in your files
Files you upload and text you paste are processed only in server memory for your session. The only provider involved is our hosting provider.
| Name | Purpose | Data involved | Location | Transfer mechanism |
|---|---|---|---|---|
| Microsoft Azure (Microsoft Corporation) | Cloud hosting: runs the tools; holds session data in server memory | Content of uploaded files and pasted text, for the session only; server logs without file contents | Microsoft Azure, East US 2 (United States) | EU Standard Contractual Clauses and EU-US Data Privacy Framework certification, UK Addendum and UK Extension, Swiss adjustments, under Microsoft's Data Protection Addendum |
No other provider receives the content of your tool files. In particular, your files are not sent to any AI model provider. If you choose to attach a file to a support email, that attachment is held by our support mailbox provider (section 2) until it is deleted, within 7 days.
2. Providers for subscription, billing and support
These providers handle data we hold as controller, as described in our Privacy Notice. They do not receive the content of your tool files.
| Name | Purpose | Data involved | Location | Transfer mechanism |
|---|---|---|---|---|
| Microsoft Azure | Hosting of billing, subscription, acceptance-log and support records, and their backups | Name, email, company, billing country, subscription and payment events, hashed license key, support tickets | Microsoft Azure, East US 2 (United States) | As in section 1 |
| Dodo Payments | Merchant of Record: checkout, payment, sales tax, VAT and GST, invoices, refunds, chargebacks, license keys | Name, email, billing address, tax ID, payment details (card data stays with Dodo and its payment processors) | United States and India | Standard Contractual Clauses, UK Addendum. Dodo acts as an independent controller for payment data |
| Rekomi | Partner referral tracking, commission calculation and payouts | Partner name, email, payout details; referral code and payment amounts linked to customer subscriptions | To be confirmed | To be confirmed before any EU or UK partner is onboarded |
| Zoho Mail | Support mailbox | Support emails, replies, and any attachment you choose to send (attachments deleted within 7 days) | To be confirmed | Chosen only from providers that offer Standard Contractual Clauses and the UK Addendum |
| Anthropic, PBC | Drafts replies to support emails (Claude API) | Text of support email threads and our documentation. Not tool files, not attachments | United States | Standard Contractual Clauses, UK Addendum, under Anthropic's commercial terms and data processing addendum. Not used for model training |
| Sentry (Functional Software, Inc.), if enabled | Error reports | Stack traces, time, tool id, browser type; configured to exclude file contents | United States or European Union, as set for our account | Standard Contractual Clauses, UK Addendum, under Sentry's data processing addendum |
3. Providers for partner outreach
These providers handle data about advisors we invite to our partner program. They do not receive customer data.
| Name | Purpose | Data involved | Location | Transfer mechanism |
|---|---|---|---|---|
| A business contact data provider | Supplies business contact details of prospective partners | Name, business email, job title, employer, business location, public profile link | United States | Standard Contractual Clauses, UK Addendum |
| Instantly | Sends partner invitation emails and records replies and opt-outs | Prospect name, business email, company, email engagement and opt-out status | United States | Standard Contractual Clauses, UK Addendum |
4. How we tell you about changes
4.1 Before a new provider starts processing the content of customer files (section 1), we give at least 30 days' notice by email to each customer's billing contact and update this page. You may object as set out in section 8 of the Data Processing Addendum.
4.2 For changes to sections 2 and 3, we update this page and its effective date before the change takes effect.
4.3 To be told of every change to this page by email, write to privacy@baseloom.app with the subject "Sub-processor updates".
5. Questions
Write to privacy@baseloom.app. We can provide a copy of the relevant data protection terms for any provider listed here, subject to that provider's confidentiality terms.