Sub-processors
Last updated: September 30, 2026
To run TrackYourShelves we engage other companies for hosting, payments, email, storage and support, and they help us process data on behalf of the businesses using the platform. This page names every one of them, what each does, what data reaches it, and where it is located, so you can answer that question without having to ask us.
What is a sub-processor?
When you use TrackYourShelves, you decide what customer information goes into it and we process that information on your behalf. Where we bring in another company to help us do that (a hosting provider, an email provider), the General Data Protection Regulation and similar privacy laws call that company a sub-processor. Naming them, and saying what each receives, is the disclosure those laws expect of us.
Due diligence
Before a provider is used we look at what it does with data, where it stores it, and the security and privacy commitments it publishes. We send each one only the data it needs for the job it does, which is what the Data column below describes.
This list is compiled from the calls the software actually makes to the outside world, rather than from memory, and updating it is part of the change that adds or removes a provider. That is deliberate: a sub-processor list that quietly goes stale is worse than none at all, because it is a statement that is no longer true.
Data categories
The table below says which categories of data reach each provider, rather than describing our systems. The categories are:
- Account data
- The account holder and their staff: names, sign-in details, contact information.
- Business data
- The records a business keeps in the platform: stock, orders, invoices, documents.
- End customer data
- Information about a business's own customers, entered by that business.
- Payment data
- Billing details and amounts. Card numbers are never included (see below).
- Support data
- The messages someone writes to us when they ask for help, and a reference code.
List of sub-processors
General infrastructure
| Name | Data | Purpose of processing | Entity country |
|---|---|---|---|
| Vercel | Account data, business data, end customer data | Hosting and delivery of the platform | United States |
| Prisma Postgres | Account data, business data, end customer data | The primary database | United States |
| Cloudflare | Account data, business data, end customer data | File storage, domain records, bot checks on public forms, and the TeamChat chat service | United States |
Payments
Card numbers are entered directly into Stripe's own hosted fields. They do not pass through our servers and we never store them.
| Name | Data | Purpose of processing | Entity country |
|---|---|---|---|
| Stripe | Account data, payment data, end customer data | Billing, and payments merchants take from their own customers | United States |
Email and user support
| Name | Data | Purpose of processing | Entity country |
|---|---|---|---|
| Amazon Web Services (SES) | Account data, end customer data | Email delivery | United States |
| Discord | Support data, account data (only in a staff-only channel) | Support ticket handling | United States |
| tawk.to | Support data, account data | Live chat support (not in use at the moment) | United States |
| Linear | Account data attached to an error (email, IP address, the page) | Tracking errors for our team to fix | United States |
Optional features
Nothing is sent to these providers for a workspace that has not turned the relevant feature on.
| Name | Data | Purpose of processing | Entity country |
|---|---|---|---|
| OpenAI | Business data, end customer data | AI assistant features (not in use at the moment) | United States |
| Expo | Device notification token, notification text | Push notifications to the mobile app | United States |
| Account data, business data | Optional calendar sync | United States | |
| 20i | Business data, end customer data | Hosting and domains for websites we build or host for you | United Kingdom |
Service providers
We also use ordinary business services for our own operations, such as accounting and productivity tools. Those do not receive the customer data you put into the platform, so they are not sub-processors and are not listed above.
Affiliates
None. TrackYourShelves is operated by a single company registered in the state of Georgia, United States. There are no group companies, parent companies or overseas entities that your data is shared with.
Updates to this page
When a provider is added or removed, this page changes with it, and the date at the top shows when it last changed.
If you would like to be told in advance of a change, write to privacy@trackyourshelves.com and we will add you to the notice list. If you object to a new sub-processor, tell us at the same address and we will work through it with you.
See also our Data Processing Agreement, Privacy Policy, Terms of Service and Trust Center.