Sub-processors
These are every third party that processes merchant data on our behalf. This list is the one referenced by our Data Processing Addendum, and it is kept current.
Current sub-processors
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Fly.io, Inc. | Application hosting and database | All merchant store data and account data | EU (Frankfurt) |
| Tigris Data, Inc. | Off-site backups | Database snapshots | EU only — Frankfurt and Amsterdam |
| Resend (Plus Five Five, Inc.) | Transactional email: support replies, weekly reports, alerts | Merchant email address, shop domain, report contents | United States, under Standard Contractual Clauses |
The backup bucket is pinned to European regions, so snapshots are stored and replicated only within the EU rather than distributed globally. Backups are held for 14 days on a rolling window.
Each provider is bound by a data processing agreement with terms at least as protective as those we owe you, and transfers outside the EEA, where any occur, rely on the European Commission's Standard Contractual Clauses.
Not sub-processors
Shopify is the source of your store data and your billing provider; it is a controller in its own right, not our sub-processor.
Meta, Google, TikTok and Snapchat are sources you may choose to connect. We read data from them; we send them none of your data. They are not sub-processors either.
We use no analytics, advertising, session-recording, error-tracking or AI provider that receives merchant data.
Changes to this list
Before adding or replacing a sub-processor that handles merchant data, we give at least 30 days' notice in the app and by email. If you object on reasonable data protection grounds within that window, you may terminate your subscription without penalty and receive a pro-rata refund of any prepaid period.
To be notified of changes, or to raise an objection, write to support@profytly.io. See also our Data Processing Addendum.