We keep this list short on purpose. Each party below is engaged under a written agreement that limits it to our documented instructions, requires confidentiality, and imposes security obligations at least as protective as our own.
Current sub-processors
Stripe, Inc.
Purpose: Payments and subscription billing
Data received: Name, email address, billing address, country, phone number, plan and amount. Card details go from your browser directly to Stripe — they never reach our servers.
Processing location: United States (global processing)
Their privacy notice
Anthropic, PBC
Purpose: AI rewrites and listing analysis
Data received: The listing text you submit for a rewrite — title, bullet points, description and category. No account, billing or marketplace credentials are sent. Content is not used to train models.
Processing location: United States
Their privacy notice
Neon, Inc. (Databricks)
Purpose: Managed PostgreSQL database
Data received: All application data at rest: accounts, workspaces, listings, scores, snapshots, encrypted marketplace credentials and billing profiles.
Processing location: United States — AWS us-east-2 (Ohio)
Their privacy notice
Functional Software, Inc. (Sentry)
Purpose: Error and crash reporting
Data received: What went wrong, not who it happened to: the error, the stack trace, the route path and the release. Request bodies, headers, cookies and query strings are removed before an event leaves our server, and the only thing identifying a person is an internal account id — no name, no email address, no listing content. It is here because on shared hosting an unread log file is the same as no log at all, and a fault nobody sees is a fault nobody fixes.
Processing location: United States
Their privacy notice
Namecheap, Inc.
Purpose: Web and application hosting, outbound email delivery
Data received: Anything served or sent by the application, including server logs and the transactional emails we send you.
Processing location: United States
Their privacy notice
ipwho.is
Purpose: Placing an IP address in a security alert
Data received: The IP address a sign-in, password change or email change came from — and nothing else. No name, no account, no identifier, no cookie. We send it so the alert can say "Chattogram, Bangladesh — ADN Telecom" instead of a number you have no way to judge. Private and internal addresses are never sent, and results are cached for six hours so the same address is not looked up repeatedly.
Processing location: European Union
Their privacy notice
Google LLC
Purpose: Sign in with Google; address suggestions at checkout
Data received: If you choose Google sign-in: your name, email address and Google account identifier. If you use address suggestions: the partial address you type. Not used if you sign in with a password and type your address in full.
Processing location: United States (global processing)
Their privacy notice
Not sub-processors
These are systems we call for you rather than services acting for us. Your relationship with each is your own.
- Amazon Selling Partner API — Your own seller account. We call it with credentials you supply, on your instruction, to read your listings, orders, inventory and fees.
- Walmart Marketplace API — Your own seller account, on the same basis.
Changes to this list
Before a new sub-processor starts handling customer data we will update this page and, where you have a Data Processing Agreement with us, give at least 30 days’ notice by email. If you object on reasonable data-protection grounds within that period, tell us and we will work to find an alternative; if we cannot, you may cancel and receive a refund of the unused prepaid period.
Asking to be told
To be notified of changes, ask through the contact form and we will add you to the notification list for this page.
Questions about this document
Write to us through the contact form and say which document you are asking about. A person reads every message. Our postal address is 5005 W Laurel St, Tampa, FL 33607, United States.