Skip to content

Legal

Data processing overview

Where your data lives, and which processors are involved.

Roles

You are the controller of the data you connect. Promote HQ is a processor acting on your instructions.

Processors

  • Supabase — Postgres database, authentication and object storage.
  • Vercel — application hosting, edge network and background job triggers.
  • Stripe — subscription billing, invoicing and tax.
  • AI provider — the provider you or we configure for generation tasks; structured prompts only.
  • Email provider — transactional and digest email where configured.

Data flows

flowchart LR
  U[User] -->|OAuth| P[Promote HQ]
  P -->|RLS-scoped reads/writes| DB[(Supabase Postgres)]
  P -->|encrypted tokens| V[(Storage)]
  P -->|sub/customer| S[Stripe]
  P -->|grounded prompt| AI[AI provider]
  P -->|official API| SP[Social providers]
  S -->|signed webhook| P
  SP -->|post + metrics| P

Security measures

Encryption at rest and in transit, AES-256-GCM envelope encryption for tokens and keys, least-privilege OAuth scopes, audit logging, and configurable retention.