# Our sub-processors

Last updated 2026-10-28.
Web version: https://commitandpush.io/privacy/subprocessors/

These suppliers process personal data for Commit & Push. We give merchants at least 14 days' notice before a new supplier starts processing their customers' data.

Each supplier uses suppliers of its own. Where it publishes a list of them, we link to it; they are bound by that supplier's data processing terms.

"Your customers' data" means:

- Stored: The supplier stores your customers' data for us.
- In transit only: Your customers' data passes through the supplier on its way to you, but the supplier does not keep it.
- Incidental: The supplier is not meant to receive your customers' data, but it can occasionally see some, for example in an error report, an email or a support message.
- No: The supplier only handles data about merchants, their staff or website visitors, for which we are the controller.

### Cloudflare (Cloudflare, Inc.)

- Purpose: Website hosting, content delivery, security and request statistics; the network every request to our websites and apps passes through
- Applies to: Websites, Discount Magic
- Data: IP addresses and request details (page, browser, time). For Discount Magic, all app traffic in transit, including your customers' data shown in the app
- Your customers' data: In transit only
- Stored in: Page and app content is not stored. Request statistics are kept on Cloudflare's network
- Accessed from: Cloudflare data centres worldwide, usually the one nearest the visitor; Cloudflare support staff in the UK, EU, United States and other countries
- Transfer safeguard: EU-US Data Privacy Framework and UK Extension; Standard Contractual Clauses with the UK Addendum
- Needed to run the service: Required
- Terms: https://www.cloudflare.com/cloudflare-customer-dpa/
- Cloudflare's own suppliers: https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/
- Added: 2026-09-20

### PostHog (PostHog, Inc.)

- Purpose: Website analytics (only with consent) and product analytics for our apps
- Applies to: Websites, Discount Magic
- Data: Pseudonymous identifiers, pages and app events, browser and device type, store domain; session replays if used, with customer details and personal-data fields hidden. Designed to leave out your customers' data, but general text such as discount titles can occasionally include some
- Your customers' data: Incidental
- Stored in: United States
- Accessed from: United States; PostHog staff in other countries where needed to provide the service, under its DPA
- Transfer safeguard: EU-US Data Privacy Framework and UK Extension; Standard Contractual Clauses with the UK Addendum
- Needed to run the service: Required
- Terms: https://posthog.com/dpa
- PostHog's own suppliers: https://posthog.com/subprocessors
- Added: 2026-09-20

### Google Cloud (Google Cloud EMEA Limited (Ireland), with Google LLC)

- Purpose: App hosting, short-term caching and sessions, background jobs, message queues, file storage, logs and secret storage
- Applies to: Discount Magic
- Data: All app data, including your customers' data
- Your customers' data: Stored
- Stored in: United States, encrypted at rest. The cache, in Northern Virginia (us-east4), keeps recently used app data, including customer lists, for up to 15 minutes, with no backups
- Accessed from: United States; Google staff in other countries where needed to support the service, under Google's DPA
- Transfer safeguard: Contract with Google Cloud EMEA Limited in Ireland; transfers to Google LLC in the United States under the EU-US Data Privacy Framework and UK Extension, with Standard Contractual Clauses as backup
- Needed to run the service: Required
- Terms: https://cloud.google.com/terms/data-processing-addendum
- Google Cloud's own suppliers: https://cloud.google.com/terms/subprocessors
- Added: 2026-10-12

### PlanetScale (PlanetScale, Inc.)

- Purpose: App database and backups
- Applies to: Discount Magic
- Data: All app data, including your customers' data
- Your customers' data: Stored
- Stored in: United States, with daily encrypted backups kept for 30 days, also in the United States
- Accessed from: United States; PlanetScale staff in other countries where needed to support the service, under its DPA
- Transfer safeguard: EU-US Data Privacy Framework and UK Extension; Standard Contractual Clauses with UK transfer clauses
- Needed to run the service: Required
- Terms: https://planetscale.com/legal/dpa
- PlanetScale's own suppliers: https://planetscale.com/legal/subprocessors
- Added: 2026-10-12

### Sentry (Functional Software, Inc.)

- Purpose: Error monitoring, performance tracing and app logs, including masked screen replays of a sample of sessions and of sessions where an error happens
- Applies to: Discount Magic
- Data: Error details and app logs, Shopify user ID, store domain, masked replays of app screens. These are designed to leave out your customers' data, but an error can occasionally capture some
- Your customers' data: Incidental
- Stored in: United States, kept for up to 90 days
- Accessed from: United States; Sentry staff in other countries where needed to support the service, under its DPA
- Transfer safeguard: EU-US Data Privacy Framework and UK Extension; Standard Contractual Clauses with the UK Addendum
- Needed to run the service: Required
- Terms: https://sentry.io/legal/dpa/
- Sentry's own suppliers: https://sentry.io/legal/subprocessors/
- Added: 2026-10-12

### Featurebase (CORDNET OÜ)

- Purpose: In-app support chat, feedback, product updates and opt-in marketing emails
- Applies to: Discount Magic
- Data: Staff name, email, language and role; store name, domain and plan; messages you send, which can include details of your customers if you share them
- Your customers' data: Incidental
- Stored in: European Union (Germany, Ireland and the Netherlands)
- Accessed from: European Union; some of Featurebase's own suppliers, including AI providers, are in the United States
- Transfer safeguard: Stored in the EEA, which UK law recognises as adequate; transfers to Featurebase's US suppliers are covered by the Standard Contractual Clauses, with the UK Addendum for UK data, in Featurebase's data processing agreement, and we remain responsible for them under ours
- Needed to run the service: Required
- Terms: https://help.featurebase.app/articles/6556750
- Featurebase's own suppliers: https://help.featurebase.app/articles/2733677-subprocessors
- Added: 2026-10-12

### Google Analytics (Google Ireland Limited, with Google LLC)

- Purpose: Measuring visits to our Shopify App Store listings and installs that come from them
- Applies to: Shopify App Store
- Data: Pages viewed, clicks, browser and device details, approximate location, referral source and search terms, and for installs the store's Shopify ID, name and web address
- Your customers' data: No
- Stored in: United States and other Google data centres
- Accessed from: Collected through servers in the EU and UK, then processed by Google in the United States and other countries
- Transfer safeguard: Contract with Google Ireland Limited in Ireland; transfers to Google LLC in the United States under the EU-US Data Privacy Framework and UK Extension, with Standard Contractual Clauses as backup
- Needed to run the service: Optional
- Terms: https://business.safety.google/adsprocessorterms/
- Google Analytics's own suppliers: https://business.safety.google/subprocessors/
- Added: 2026-10-12

### Google Workspace (Google Cloud EMEA Limited (Ireland), with Google LLC)

- Purpose: Email, including messages you send to our privacy and support addresses
- Applies to: Websites, Discount Magic
- Data: Your emails to us and our replies
- Your customers' data: Incidental
- Stored in: Google data centres worldwide, including the United States
- Accessed from: Google data centres worldwide; Google staff in other countries where needed to support the service, under Google's DPA
- Transfer safeguard: Contract with Google Cloud EMEA Limited in Ireland; transfers to Google LLC in the United States under the EU-US Data Privacy Framework and UK Extension, with Standard Contractual Clauses as backup
- Needed to run the service: Required
- Terms: https://cloud.google.com/terms/data-processing-addendum
- Google Workspace's own suppliers: https://workspace.google.com/terms/subprocessors/
- Added: 2026-10-12

## Changes to this list

| Date | Supplier | Change |
|---|---|---|
| 28 October 2026 | Google Cloud | Now also provides short-term caching and sessions for Discount Magic, replacing Upstash |
| 28 October 2026 | Upstash | Removed: Discount Magic caching moved to Google Cloud, and our Upstash data was deleted |
| 12 October 2026 | Featurebase | Added for Discount Magic support and product updates; it can see your customers' details if you share them in a support message |
| 12 October 2026 | Google Analytics | Added for Shopify App Store listing analytics |
| 12 October 2026 | Google Cloud | Added for Discount Magic hosting |
| 12 October 2026 | Google Workspace | Added for email |
| 12 October 2026 | PlanetScale | Added for the Discount Magic database |
| 12 October 2026 | Sentry | Added for Discount Magic error monitoring |
| 12 October 2026 | Upstash | Added for Discount Magic caching |
| 20 September 2026 | Cloudflare | Added for website hosting and security |
| 20 September 2026 | PostHog | Added for website analytics |