Supernormal and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No for the web platform on Pro and Business: the Terms say Supernormal will not train any AI model on your content. The desktop/mobile App is excluded; its content falls under the Privacy Notice, which has no training clause.

Vendor's wording: “Supernormal will not use or share any Customer Materials (including Output) provided or generated from Customer’s use of the Supernormal Platform to train any AI or machine learning models (including Supernormal’s).”

Source: supernormal.com5.3 AI Models; TrainingChecked on 20 October 2026

United States: the sub-processors for data management (AWS, Google Cloud, Azure) are listed in the USA, and the DPA authorises transfers from the EEA to the US.

Vendor's wording: “Customer authorizes Supernormal and its Subprocessors to transfer Customer Personal Data across international borders, including from the European Economic Area, Switzerland, and/or the United Kingdom to the United States.”

Source: supernormal.comAttachment 1, Cross-Border TransfersChecked on 19 October 2026

DPA in the terms.

Yes. A Data Processing Addendum is attached to the terms (Attachment 1) and applies to company customers automatically; the security page says a DPA is available for every customer.

Vendor's wording: “This Data Processing Addendum (including its Exhibits) (“Addendum”) forms part of and is subject to the terms and conditions of the End User Terms (the “User Terms”) by and between Customer and Supernormal.”

Source: supernormal.comAttachment 1 Data Processing AddendumChecked on 19 October 2026

Published.

Yes, public list at https://www.supernormal.com/subprocessors (updated 29 May 2026): 19 sub-processors, all in the USA. AI providers: Anthropic, OpenAI, Microsoft Azure; also AssemblyAI (transcription).

Vendor's wording: “Supernormal engages the third-party providers in the table below to perform limited activities in connection with the services provided.”

Source: supernormal.comSubprocessors tableChecked on 19 October 2026

Not listed.

No listing found for search term 'Supernormal'

Source: dataprivacyframework.govSearch 'Supernormal' returned 'Query returned no results'Checked on 19 October 2026

The Business plan lists a 'Data retention' setting (period not published). At the end of the terms Supernormal deletes customer personal data; backups are deleted on its own retention schedule (no period given).

Vendor's wording: “At the expiry or termination of the User Terms, Supernormal will delete all Customer Personal Data (excluding any back-up or archival copies which shall be deleted in accordance with Supernormal’s data retention schedule)”

Source: supernormal.comAttachment 1, Customer Personal Data DeletionChecked on 19 October 2026

SOC 2 (1 named; audited annually, report under NDA). It also claims HIPAA support (BAA) and GDPR compliance, which are not certifications.

Vendor's wording: “Audited annually by an independent third party against the security, availability, and confidentiality criteria. Report available under NDA.”

Source: supernormal.comCertifications and frameworksChecked on 19 October 2026