Sub-processors
The third-party service providers Sponja uses to process customer data, what each one does, and where they are located.
Last updated: June 12, 2026
Sponja (operated by Popup Moments Inc.) uses a small set of third-party service providers ("sub-processors") to deliver the platform. A sub-processor is a vendor we engage that may process personal data on behalf of our customers as part of providing the service. This page is the authoritative, current list. It is referenced by our Data Processing Agreement and our Privacy Policy.
1. Sub-processors
| Vendor | Purpose | Data involved | Location |
|---|---|---|---|
| Google LLC | AI processing (Gemini API) and cloud infrastructure (Firebase Authentication, Firestore, Cloud Storage, Cloud Functions, Cloud Tasks) | Event recordings, transcripts, attendee chat messages, participant names and emails, AI prompts and outputs, account data | United States |
| Deepgram, Inc. | Speech-to-text transcription of event recordings | Recording audio, accessed via short-lived signed URLs | United States |
| Stripe, Inc. | Payment processing and billing | Billing contact and payment details | United States |
| Vercel Inc. | Web application hosting | Account data and content in transit | United States (global edge) |
| PostHog, Inc. | Product analytics and session replay of the Sponja dashboard | User email and name, product usage events, dashboard session recordings | European Union |
| Functional Software, Inc. (Sentry) | Error monitoring for the processing pipeline | Error context and stack traces | United States |
| Astrodon Corporation (Loops) | Transactional and lifecycle email to Sponja users | User email, name, account and trial state | United States |
| Crisp IM SAS | In-app support chat | User email, name, support conversation content | European Union |
| Upstash, Inc. | API rate limiting | IP addresses and email addresses as short-lived rate-limit counters | United States |
| Mux, Inc. | Hosting and streaming of in-app tutorial videos | Viewer IP address and playback telemetry | United States |
A note on AI processing: requests to the Gemini API run under Google's paid API terms, which prohibit Google from using submitted content to train its models. Customer recordings are transcribed by Deepgram and analyzed by Google Gemini. No other AI vendors receive customer content.
2. Integrations you connect
Zoom and Kit are not sub-processors. They are platforms you connect to Sponja yourself and authorize directly:
- Zoom: when you connect Zoom, Sponja reads post-event data (cloud recording, attendee report, chat) from your own Zoom account under the OAuth grant you approve. See how the Zoom integration works.
- Kit: when you connect Kit, Sponja pushes generated follow-up drafts into your own Kit account. That data lives in your Kit account under your agreement with Kit.
You can disconnect either integration at any time, which stops all data flow.
Advertising and marketing tags on our public website (Meta, Google Ads, LinkedIn) are consent-gated and described in our Privacy Policy. They do not process customer event data.
3. Changes to this list
We update this page when our sub-processors change. Material additions are posted at least 14 days before the new sub-processor begins processing customer data.
If you have questions about this list, or want to be notified of changes directly, email hi@sponja.ai.
