Privacy Policy
This policy explains how Dumpling Software UG (haftungsbeschränkt), Kollwitzstrasse 76, 10435 Berlin, Germany (“Supadata”, “we”) processes personal data on supadata.ai, the dashboard, the documentation, the playground and the Supadata API. We are the controller for this processing. Contact us at [email protected].
For content our customers submit to the API, we act as their processor under our Data Processing Agreement. Section 6 explains what happens to that content.
1. What we process and why
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| IP address, browser and device data, pages visited | Running the website securely, preventing abuse | Legitimate interest, Art. 6(1)(f) | Server logs 30 days |
| Analytics events and identifiers from consent-based tools (section 3) | Understanding usage, testing page variants | Consent, Art. 6(1)(a) | Until consent is withdrawn |
| Playground: URL you enter, result, IP address, bot-protection signals | Running your request, rate limiting | Contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) | As long as needed for abuse prevention |
| Name, email, password (hashed), organisation, sign-in provider profile, two-factor secrets | Creating and securing your account, communicating with you | Contract, Art. 6(1)(b) | Until you delete your account |
| Email checked against a disposable-address service at sign-up | Preventing fraud | Legitimate interest, Art. 6(1)(f) | Not stored by the service |
| API keys, usage counters, request logs (endpoint, status, timing, IP, user agent) | Providing the API, billing, security | Contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) | For the duration of your customer relationship |
| Billing name and address, VAT ID, invoices, payment method (held by Stripe) | Charging, invoicing, tax compliance | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) | 10 years (German tax law) |
| Support messages and feedback | Answering you | Contract, Art. 6(1)(b) | 2 years after last contact |
| Newsletter email address | Sending the newsletter you asked for (double opt-in) | Consent, Art. 6(1)(a) | Until you unsubscribe |
| Registered users’ email and name | Onboarding emails and product updates | Legitimate interest, Art. 6(1)(f), § 7(3) UWG; opt out any time | Until you opt out |
| Affiliate partners: name, email, payout details, referral statistics | Running the affiliate programme through Tolt | Contract, Art. 6(1)(b) | For the affiliate agreement |
You can opt out of marketing emails via the unsubscribe link in every marketing email, or by contacting us at [email protected]. Transactional emails (verification, password reset, usage alerts) are part of the service.
2. Recipients and international transfers
We share personal data with providers that act on our behalf under data-protection agreements. They are listed with purpose and location at supadata.ai/legal/sub-processors. Several are in the United States; for those we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses. We also disclose data where the law requires it or to enforce our Terms. We do not sell personal data.
3. Cookies and tracking
We ask for your consent before setting non-essential cookies or reading non-essential data from your device (§ 25 TDDDG). You can change your choice at any time through “Cookie settings” in the footer.
- Essential, no consent needed: sign-in session, your cookie choice, Cloudflare Turnstile bot protection, and our self-hosted Plausible Analytics, which uses no cookies or persistent identifiers.
- Analytics, with consent: PostHog (usage events, A/B test variants, 1 year), Google Tag Manager and Google Analytics (up to 2 years), and Datafast (website analytics). Data is processed in the United States.
- Marketing, with consent: Tolt affiliate cookie, 90 days.
- Error monitoring, with consent: Sentry error reports and, for a sample of dashboard sessions, a replay of the interactions leading to an error.
4. Your rights
You have the right to access, rectify and erase your personal data, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time. You can delete your account yourself in the dashboard. For everything else, email [email protected]. We respond within one month of receiving your request; where the complexity or number of requests requires it, we may extend this by up to two further months and will tell you within the first month if we do. We may ask you to verify your identity. Requests that are manifestly unfounded or excessive, in particular because they are repetitive, may be refused or charged a reasonable fee.
You also have the right to lodge a complaint with a data protection supervisory authority.
5. Security
We use encryption in transit, encryption at rest by our infrastructure providers, multi-factor authentication for staff, and two-factor authentication and API key rotation for your account. Details are in the Annex to the Data Processing Agreement.
6. Content processed through the API
Our customers use the API to fetch publicly available videos, audio, web pages and metadata and to obtain transcripts and structured data from them. We process that content on their behalf as their processor under the Data Processing Agreement; customers are responsible for having a legal basis for what they do with the results. Job results can be retrieved for 1 hour (single jobs) or 24 hours (batch jobs) and are then deleted. Results of public content may be cached for performance optimization. We do not store media files supplied through a direct file URL; we may briefly cache the URL and a failure marker so that a file that could not be processed is not fetched again. To have content removed from our cache, email [email protected] with its URL.
7. Children
The services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 16.
8. Changes
We may update this policy when our services or the law change. The date at the top shows the current version.
Version 1.0 · Last updated: 5 August 2026