Subprocessors
Last updated: April 11, 2026
A subprocessor is a third party engaged by BigBoost AI LLC to process Personal Data on behalf of our customers in connection with the Cosma platform. This page lists our current subprocessors, the purpose of each engagement, and the location where data is processed. We review this list whenever our infrastructure changes and update it accordingly.
1. Infrastructure & Platform Subprocessors
These subprocessors provide the core infrastructure that runs Cosma. Any Personal Data processed through the Service passes through one or more of them.
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Clerk, Inc. | User authentication, session management, MFA, organization membership | Name, email, password hash, session tokens, organization IDs | United States |
| Google Cloud (BigQuery) | Data warehouse for advertising performance data | Ad account IDs, campaign metrics, ad creative metadata, keywords, search terms, conversions | United States |
| Supabase (AWS) | Application database for settings, team data, analysis results, and encrypted OAuth tokens | Account settings, team assignments, anomaly records, encrypted refresh tokens | US-East-1 (United States) |
| Vercel, Inc. | Frontend hosting and global edge delivery | HTTP request metadata, IP address, browser headers | Global edge network |
| Hostinger International Ltd. | Application server running the Cosma API and background sync workers | In-flight API payloads, transient advertising data during sync | Mumbai, India |
| Functional Software, Inc. (Sentry) | Application error monitoring and performance telemetry | Stack traces, request paths, user ID hash, release version (no raw tokens or credentials) | United States |
2. Advertising Platform APIs
Cosma connects to the following advertising platforms via OAuth, at the customer's direction, to retrieve performance data. These are data sources rather than traditional subprocessors, but they are listed here for transparency because Personal Data (in the form of ad account identifiers and tied user metadata) flows between Cosma and each platform.
| Platform | Purpose | Data Exchanged | Location |
|---|---|---|---|
| Google Ads API | Sync Google Ads campaign structure, performance, and creative data | OAuth tokens, customer IDs, performance reports | United States |
| Meta Marketing API | Sync Meta (Facebook/Instagram) ads campaign structure and performance data | OAuth tokens, act_ account IDs, insights reports | United States |
| Microsoft Advertising API | Sync Microsoft (Bing) Advertising campaign structure and performance data | OAuth tokens, customer IDs, performance reports | United States |
3. Contractual Safeguards
All subprocessors listed above are bound by written contracts that impose data protection obligations at least equivalent to those in our Data Processing Agreement. Where a subprocessor is located outside the EEA, transfers are made under Standard Contractual Clauses or an equivalent lawful transfer mechanism.
4. Notification of Changes
We will update this page whenever we add or replace a subprocessor. Customers with an active subscription are notified by email at least 30 days before a new subprocessor is engaged, giving them the opportunity to object on reasonable grounds. To receive these notifications, ensure your billing contact email is current in Settings.
5. Historical Changes
April 11, 2026 — Initial publication of the Subprocessors list.
Contact
BigBoost AI LLC · 30 N Gould St Ste R, Sheridan, WY 82801
Questions about subprocessors: privacy@cosma.ad