superglue procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ If Personal Data is transferred outside the European Economic Area, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Subject to the conditions in applicable law, you may have the right to: access your personal data and receive a copy; correct inaccurate or incomplete data; request deletion; restrict processing; receive portable data in a machine-readable format; object to processing based on legitimate interests or direct marketing; withdraw consent at any time; and lodge a complaint with a data protection authority. To exercise a right, email security@superglue.ai . We may request information needed to verify your identity. We respond without undue delay and generally within one month. Complex requests may take up to two additional months, and we will explain the extension. Withdrawing consent does not affect processing that was lawful before the withdrawal. You can unsubscribe from marketing emails through the link in each message. You may complain to the supervisory authority where you live or work, or where an alleged infringement occurred. Our lead authority is the Bavarian State Office for Data Protection Supervision (BayLDA) .” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Upon reasonable notice, you may audit our compliance with this DPA, or appoint a third-party auditor to do so, subject to confidentiality obligations.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ This Data Processing Addendum ("DPA") forms part of these Legal Terms and applies where we process personal data on your behalf as a data processor.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Some service providers may process personal data in countries outside the European Economic Area ("EEA"). When personal data is transferred outside the EEA, we use a legally recognized transfer mechanism and appropriate safeguards. Depending on the recipient and destination, these safeguards may include an applicable European Commission adequacy decision, the EU-US Data Privacy Framework for certified recipients, or the European Commission's Standard Contractual Clauses. We may also use supplementary technical and organizational measures. You may request information about the safeguards used for a transfer, or a copy where available, by emailing security@superglue.ai . We may redact information that is confidential or protected by law.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Production database backups 30 days; deleted data can remain in encrypted backups until the backup expires Invoices, billing, and financial records 10 years, where required by German tax and commercial law Contracts and agreements Up to 10 years after termination, where required Marketing contacts Until consent is withdrawn, you object, or the data is no longer needed We may keep data longer during a legal hold, dispute, investigation, or when law requires it. We delete or anonymize data when the retention period ends. If we restore a backup, we reapply documented deletion requests.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We will maintain certain data that you transmit to the Services for the purpose of managing the performance of the Services, as well as data relating to your use of the Services. Although we perform regular routine backups of data, you are solely responsible for all data that you transmit or that relates to any activity you have undertaken using the Services. You agree that we shall have no liability to you for any loss or corruption of any such data, and you hereby waive any right of action against us arising from any such loss or corruption of such data.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Active account and customer data For the service term; deletion from live systems within 30 days after a valid account deletion request or termination Workflow configurations and integration credentials For the service term; until account termination or integration removal ” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Upon termination: your right to use the Services will immediately cease you may request export of your Customer Data and Customer Configurations within 30 days we will delete your Customer Data and Customer Configurations within 30 days, unless retention is required by law any provisions of these Legal Terms that by their nature should survive termination shall survive (including, without limitation, ownership provisions, warranty disclaimers, indemnity, and limitations of liability)” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We retain personal data only for the relevant business purpose, contract, legal requirement, or legal claim. Our current retention schedule is:” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Application, security, access, database, and audit logs For the duration of the business relationship ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ AWS Cloud hosting, databases, storage, security services, authentication infrastructure, and AI model access through AWS Bedrock ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Google Workspace Business email, documents, calendars, customer communications, and collaboration Slack Internal communications, collaboration, support coordination, and operational alerts Langfuse AI observability, tracing, evaluation, and performance monitoring PostHog Website and product analytics, usage measurement, and feature management We require vendors that process personal data for us to use appropriate safeguards and process data under written terms. We may also disclose data when required by law, to protect legal rights, or as part of a merger, financing, acquisition, or sale of assets.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Amazon Web Services, Inc. Cloud infrastructure, compute, storage, databases, and AI model access through AWS Bedrock GitHub, Inc. Source control, software development, and deployment workflows Stripe, Inc. Payment processing Google Workspace Business email, documents, calendars, and collaboration Slack Technologies, LLC Communications, collaboration, support coordination, and operational alerts PostHog, Inc. Product analytics ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We use the following vendors from our current Trust Center . A vendor receives personal data only when required for its function.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may engage sub-processors to process Personal Data. We will notify you of any intended changes to sub-processors, giving you the opportunity to object.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ We may, from time to time, make changes to the subscription fee and will communicate any price changes to you in accordance with applicable law. Price changes will take effect at the start of the next subscription period following the date of the price change.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Your subscription will continue and automatically renew unless canceled. You consent to our charging your payment method on a recurring basis without requiring your prior approval for each recurring charge, until such time as you cancel the applicable order. The length of your billing cycle will depend on the type of subscription plan you choose when you subscribed to the Services.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ You can cancel your subscription at any time by logging into your account or contacting us using the contact information provided below. Your cancellation will take effect at the end of the current paid term. If you are unsatisfied with our Services, please email us at security@superglue.ai .” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.