Sub-processors
When you use the app, your shop is the controller of your customers’ data and we are your processor. The companies below help us run the service. Each one processes data only on our instructions, under a written agreement with the same protections as our agreement with you.
| Sub-processor | What for | Data | Where | Safeguards |
|---|---|---|---|---|
| Cloud hosting (Amazon Web Services) | Servers, the database, file storage and the first copy of the backups | Everything stored in the app | European Union (Stockholm, Sweden) | EU region only; encryption at rest and in transit; data processing addendum |
| Backup storage (Backblaze) | A second copy of the backups, outside Amazon Web Services | Backups of everything stored in the app, encrypted | European Union (Amsterdam, Netherlands) | Encrypted with our keys before it leaves Amazon Web Services, so Backblaze cannot read it; EU region only; data processing addendum |
| E-mail delivery (Brevo) | Sending e-mails to you and to your customers | E-mail address, name, the message | European Union | Data processing agreement; EU processing |
| SMS delivery (BulkGate) | Sending SMS to your customers | Phone number, the message | European Union (Czech Republic) | Data processing agreement; message texts kept only as long as needed for delivery reports |
| Card payments (Stripe) | Your subscription payments | Your billing details (not your customers’) | European Union and United States | Standard Contractual Clauses; PCI DSS; Stripe never receives your customers’ data |
| Error tracking (Sentry) | Finding and fixing errors | Technical data of a failed request (no form contents, no customer data by design) | European Union | Data processing agreement; personal data scrubbed before sending |
| DNS, content delivery and e-mail routing (Cloudflare) | Delivering the website and the help centre, protecting them from attacks, and passing support e-mails and their replies to us | IP addresses, technical request data; the support e-mails of a ticket | Global network, EU data localisation where available | Standard Contractual Clauses; data processing addendum |
| Support mailbox (to be confirmed) | The mailbox where our team reads and answers your support tickets | What you write in a ticket and your contact details | To be confirmed | Data processing agreement |
Changes
Section titled “Changes”We tell shop owners at least 30 days before a new sub-processor starts processing customer data. You can object as described in the data processing agreement (Settings → Privacy in the app).