These companies process personal data on our behalf. We notify merchants at least 30 days before adding a new one.
| Company | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, database (D1), network delivery, DDoS protection | All service data | Database in Western Europe; global edge network. EU-US Data Privacy Framework and SCCs. |
| Google LLC | Web font in the dashboard | IP address of dashboard users | Global. EU-US Data Privacy Framework. |
| Anthropic, PBC | AI: reading the item lines from a photographed receipt at a till station, and writing sales advice. Only when the shop switches these on. | The receipt photo (what is printed on it, no shopper identity) and aggregated sales numbers. Photos are not stored by us after reading; API data is not used to train models. | USA. Standard Contractual Clauses. |
| Stripe Payments Europe, Ltd. | Subscription billing and invoices for merchants | Merchant billing name, address, email, VAT ID and payment method (held by Stripe, not by us) | Ireland; transfers under the EU-US Data Privacy Framework and SCCs. |
| Resend | Transactional email to merchant users (password reset) | Email address and message content | USA. Standard Contractual Clauses. |
Payment providers and POS systems you connect yourself (SumUp, myPOS, Viva, Loyverse, Square) are not our subprocessors: they act for you, and we only read your sales from them with the access you give.
Anthropic, Stripe and Resend process data only once the related feature is switched on for the service.