About this list
In short: These are the companies that help us run our websites and apps and can see personal data while doing so.
This list is part of our privacy policy. Each supplier may only use personal data to provide its service to us, under a written agreement. Shopify, which runs the platform our apps work on, and any Klaviyo account you connect yourself are not our sub-processors; the privacy policy explains how they fit in. Where your data is kept, and for how long, is summarised in Where your data is.
Each supplier uses suppliers of its own. Where a supplier publishes a list of them, we link to it below. Those suppliers are bound by that supplier's data processing terms.
We give merchants at least 14 days' notice, by email or in the app, before a new supplier starts processing their customers' data. You can object by contacting us. Every change is listed under Changes to this list and in our Atom feed, which you can follow in a feed reader without installing our apps. The list is also available as JSON.
"Your customers' data" shows whether personal data about a merchant's own customers reaches each supplier:
- Stored: The supplier stores your customers' data for us.
- In transit only: Your customers' data passes through the supplier on its way to you, but the supplier does not keep it.
- Incidental: The supplier is not meant to receive your customers' data, but it can occasionally see some, for example in an error report, an email or a support message.
- No: The supplier only handles data about merchants, their staff or website visitors, for which we are the controller.
"Needed to run the service" shows whether we could provide our websites and apps without the supplier. Optional suppliers help us understand and improve our business.
Cloudflare
Cloudflare, Inc. · Added · Terms and data protection · Cloudflare's own suppliers
- Purpose
- Website hosting, content delivery, security and request statistics; the network every request to our websites and apps passes through
- Applies to
- Websites, Discount Magic
- Data
- IP addresses and request details (page, browser, time). For Discount Magic, all app traffic in transit, including your customers' data shown in the app
- Your customers' data
- In transit only
- Stored in
- Page and app content is not stored. Request statistics are kept on Cloudflare's network
- Accessed from
- Cloudflare data centres worldwide, usually the one nearest the visitor; Cloudflare support staff in the UK, EU, United States and other countries
- Transfer safeguard
- EU-US Data Privacy Framework and UK Extension; Standard Contractual Clauses with the UK Addendum
- Needed to run the service
- Required
PostHog
PostHog, Inc. · Added · Terms and data protection · PostHog's own suppliers
- Purpose
- Website analytics (only with consent) and product analytics for our apps
- Applies to
- Websites, Discount Magic
- Data
- Pseudonymous identifiers, pages and app events, browser and device type, store domain; session replays if used, with customer details and personal-data fields hidden. Designed to leave out your customers' data, but general text such as discount titles can occasionally include some
- Your customers' data
- Incidental
- Stored in
- United States
- Accessed from
- United States; PostHog staff in other countries where needed to provide the service, under its DPA
- Transfer safeguard
- EU-US Data Privacy Framework and UK Extension; Standard Contractual Clauses with the UK Addendum
- Needed to run the service
- Required
Google Cloud
Google Cloud EMEA Limited (Ireland), with Google LLC · Added · Terms and data protection · Google Cloud's own suppliers
- Purpose
- App hosting, short-term caching and sessions, background jobs, message queues, file storage, logs and secret storage
- Applies to
- Discount Magic
- Data
- All app data, including your customers' data
- Your customers' data
- Stored
- Stored in
- United States, encrypted at rest. The cache, in Northern Virginia (us-east4), keeps recently used app data, including customer lists, for up to 15 minutes, with no backups
- Accessed from
- United States; Google staff in other countries where needed to support the service, under Google's DPA
- Transfer safeguard
- Contract with Google Cloud EMEA Limited in Ireland; transfers to Google LLC in the United States under the EU-US Data Privacy Framework and UK Extension, with Standard Contractual Clauses as backup
- Needed to run the service
- Required
PlanetScale
PlanetScale, Inc. · Added · Terms and data protection · PlanetScale's own suppliers
- Purpose
- App database and backups
- Applies to
- Discount Magic
- Data
- All app data, including your customers' data
- Your customers' data
- Stored
- Stored in
- United States, with daily encrypted backups kept for 30 days, also in the United States
- Accessed from
- United States; PlanetScale staff in other countries where needed to support the service, under its DPA
- Transfer safeguard
- EU-US Data Privacy Framework and UK Extension; Standard Contractual Clauses with UK transfer clauses
- Needed to run the service
- Required
Sentry
Functional Software, Inc. · Added · Terms and data protection · Sentry's own suppliers
- Purpose
- Error monitoring, performance tracing and app logs, including masked screen replays of a sample of sessions and of sessions where an error happens
- Applies to
- Discount Magic
- Data
- Error details and app logs, Shopify user ID, store domain, masked replays of app screens. These are designed to leave out your customers' data, but an error can occasionally capture some
- Your customers' data
- Incidental
- Stored in
- United States, kept for up to 90 days
- Accessed from
- United States; Sentry staff in other countries where needed to support the service, under its DPA
- Transfer safeguard
- EU-US Data Privacy Framework and UK Extension; Standard Contractual Clauses with the UK Addendum
- Needed to run the service
- Required
Featurebase
CORDNET OÜ · Added · Terms and data protection · Featurebase's own suppliers
- Purpose
- In-app support chat, feedback, product updates and opt-in marketing emails
- Applies to
- Discount Magic
- Data
- Staff name, email, language and role; store name, domain and plan; messages you send, which can include details of your customers if you share them
- Your customers' data
- Incidental
- Stored in
- European Union (Germany, Ireland and the Netherlands)
- Accessed from
- European Union; some of Featurebase's own suppliers, including AI providers, are in the United States
- Transfer safeguard
- Stored in the EEA, which UK law recognises as adequate; transfers to Featurebase's US suppliers are covered by the Standard Contractual Clauses, with the UK Addendum for UK data, in Featurebase's data processing agreement, and we remain responsible for them under ours
- Needed to run the service
- Required
Google Analytics
Google Ireland Limited, with Google LLC · Added · Terms and data protection · Google Analytics's own suppliers
- Purpose
- Measuring visits to our Shopify App Store listings and installs that come from them
- Applies to
- Shopify App Store
- Data
- Pages viewed, clicks, browser and device details, approximate location, referral source and search terms, and for installs the store's Shopify ID, name and web address
- Your customers' data
- No
- Stored in
- United States and other Google data centres
- Accessed from
- Collected through servers in the EU and UK, then processed by Google in the United States and other countries
- Transfer safeguard
- Contract with Google Ireland Limited in Ireland; transfers to Google LLC in the United States under the EU-US Data Privacy Framework and UK Extension, with Standard Contractual Clauses as backup
- Needed to run the service
- Optional
Google Workspace
Google Cloud EMEA Limited (Ireland), with Google LLC · Added · Terms and data protection · Google Workspace's own suppliers
- Purpose
- Email, including messages you send to our privacy and support addresses
- Applies to
- Websites, Discount Magic
- Data
- Your emails to us and our replies
- Your customers' data
- Incidental
- Stored in
- Google data centres worldwide, including the United States
- Accessed from
- Google data centres worldwide; Google staff in other countries where needed to support the service, under Google's DPA
- Transfer safeguard
- Contract with Google Cloud EMEA Limited in Ireland; transfers to Google LLC in the United States under the EU-US Data Privacy Framework and UK Extension, with Standard Contractual Clauses as backup
- Needed to run the service
- Required
Changes to this list
We add a line here whenever a supplier joins or leaves the list, or what a supplier does for us changes. The same changes appear in our Atom feed.
| Date | Supplier | Change |
|---|---|---|
| Google Cloud | Now also provides short-term caching and sessions for Discount Magic, replacing Upstash | |
| Upstash | Removed: Discount Magic caching moved to Google Cloud, and our Upstash data was deleted | |
| Featurebase | Added for Discount Magic support and product updates; it can see your customers' details if you share them in a support message | |
| Google Analytics | Added for Shopify App Store listing analytics | |
| Google Cloud | Added for Discount Magic hosting | |
| Google Workspace | Added for email | |
| PlanetScale | Added for the Discount Magic database | |
| Sentry | Added for Discount Magic error monitoring | |
| Upstash | Added for Discount Magic caching | |
| Cloudflare | Added for website hosting and security | |
| PostHog | Added for website analytics |