Belo AI Subprocessor List

Effective date: 2026-08-21
Version ID: 2026-08-21-en.5
Last updated: 2026-08-21 · published under the 2026-07-26 legal release

1. Purpose

Belo Inteligência Artificial Ltda (“Belo”) uses the suppliers below to support the provision of the Services. The legal characterization of each supplier depends on the relevant flow: some act as Belo’s subprocessors/operators; others, especially payments, marketplaces, social login, or services connected by the user, may act as independent controllers. Inclusion on this list does not expand the scope of the DPA beyond the processing in which Belo acts as an operator.

This List is versioned and organized by function. “Current provider” means the supplier enabled for a given flow on the stated date.

“Listed alternative” means a supplier already identified in this List for the same function. Customer has authorized those listed alternatives. Belo may switch among the current provider and the listed alternatives for that function without additional notice. Adding a supplier that is not already identified on this List, or a material replacement that is not a listed alternative for that function, requires the notice described in DPA §6.3. Mere technical compatibility of an unlisted provider does not mean that data are being sent to that provider.

Belo will give reasonable advance notice of at least 15 (fifteen) days before adding a Subprocessor that is not already identified on this List, or making a material replacement that is not a listed alternative for that function, allowing a reasoned objection under the DPA. Emergency changes due to security, unavailability, or legal requirements may occur on shorter notice, with notice given as soon as practicable. Updates that are merely editorial, change a corporate name, switch among listed alternatives, or change to an equivalent region without a material increase in risk do not require a new notice period.

2. List of subprocessors (by function)

Notes on AI inference. Each AI-inference row states the route in use today and the listed alternatives for the same function. Belo may switch among those listed alternatives without additional notice. Adding a supplier that is not already identified on this List, or a material replacement that is not a listed alternative for that function, requires notice under DPA §6.3. The identity of the model vendor does not change with the route; what changes is the infrastructure through which the request is served. Only the context necessary for execution should be transmitted. Belo uses enterprise/API configurations that, under the applicable terms, restrict general training using inputs and outputs. For AWS AI services used by Belo, including Amazon Translate and AWS Bedrock AgentCore, AWS Organization policy AISERVICES_OPT_OUT_POLICY is effective on account 020195185470 and reports optOut, so AWS may not use that content to improve or train AWS services or models under that mechanism. Exa Labs, the prior web-search provider, was deactivated because its public self-serve terms granted Exa a license to use user input and output to develop and improve its products and services, and no public self-serve DPA was available. This List does not guarantee permanent availability of a model, region, route, or supplier.

Vertex AI processing location. Unless the GOOGLE_VERTEX_LOCATION deployment variable is pinned to a specific region, Belo's Google Vertex AI routing (Gemini and Claude-via-Vertex) uses Vertex's global endpoint rather than a fixed United States region. "Global" is Google's routing designation, not a representation that data is confined to the United States; Belo does not currently pin this variable in production.

Platform search. The platform’s textual and similarity search is performed first-party on native PostgreSQL (and does not constitute third-party subprocessing).

3. BYOC — customer-managed deployments

BYOC (customer-cloud) deployment can be made available upon request for Corporate customers. Deployment terms, cloud environment, and provisioning conditions will be defined in a mutually executed Corporate/BYOC Addendum.

Cloud environment: the cloud environment for a BYOC deployment is the one identified in the Order Form (or equivalent technical annex) and agreed in the Addendum. Microsoft, where applicable, appears only as a social-login provider (Microsoft account / Entra ID), not as a hosting cloud or BYOC provider, unless the Order Form expressly states otherwise.

For BYOC customers:

• The customer’s cloud project/organization, as identified in the Order Form and agreed in the Addendum, hosts the runtime and Customer Content.
• Belo receives only the telemetry and licensing fields described in the Addendum and current technical documentation. Heartbeats must not contain prompts, files, row data, or customer content. If support, diagnostics, or exceptional service requires access to additional data, that processing must be limited, documented, and subject to the DPA or a specific instrument, according to the applicable role.
• The detailed field inventory is an internal engineering control and is not published as public contractual text.
• Belo processes heartbeat metadata as an independent controller under clause 6.5 of the Corporate/BYOC Addendum (Customer Content does not leave the customer environment). Aggregate counts that do not identify people are not considered personal data; fields that may identify them are processed under the Privacy and Data Notice and clause 6.5 of the Addendum — this flow is distinct from the operator relationship in Annex C of the DPA.
• Cloud marketplaces (e.g., Google Cloud Marketplace), if used as a sales channel, do not by themselves change the agreed cloud environment or the technical scope of BYOC until the Order Form and, if necessary, this List and the corresponding Addendum are expressly updated.

See the Corporate/BYOC Addendum for support, update, and open-source limits.

4. Changes and versioning

The published version must state its effective date and a summary change history. Enterprise customers may subscribe to the notification channel indicated below. The right to object does not grant a general veto over the evolution of the Services, but allows discussion of a reasonable alternative and, if infeasible, termination only of the affected Services, in accordance with the DPA.

5. Contact

Belo Inteligência Artificial Ltda
Rua da Consolação, 2302, São Paulo/SP – CEP 01302-001 – Brazil
Email: belo@belo.ai / privacy@belo.ai