Subprocessors
The companies on our public subprocessor list, what each one does for us, and where it processes data. The list is read from our register on every release, so it never lags behind it.
Updated Version 1.9
- Subprocessors on the public list
- 35
- AI providers among them
- 7
- Recipients that act as independent controllers
- 6
- DigitalOcean, LLCHosting, Singapore
- Stripe, Inc.Payments, Worldwide
- OpenAI, L.L.C.AI, United States
- Twilio SendGrid, part of Twilio Inc.Messaging, United States
- Sentry, Functional Software, Inc.Operations, United States
The list, version 1.9
35 companies, in effect since September 26, 2026, in order of what they do; the line under each name is its group.
| Subprocessor | What it does for us | Where |
|---|---|---|
| DigitalOcean, LLCHosting | Primary cloud hosting: Kubernetes, managed PostgreSQL and Valkey, object storage and the container registry | Singapore |
| Cloudflare, Inc.Hosting | DNS, CDN, firewall, DDoS protection, R2 object storage, Workers, API Shield and Turnstile bot checks | Global edge network |
| MongoDB, Inc.Hosting | Vector search and document storage for AI features | Singapore, on AWS |
| Amazon Web Services, Inc.Hosting | Theme asset storage on Amazon S3 | Singapore |
| Stripe, Inc.Payments | Billing for Tanqory plans, and merchant payments through Stripe Connect | Worldwide |
| PayPal Holdings, Inc.Payments | PayPal as a way to pay for Tanqory plans, and merchant payments through PayPal | Worldwide |
| Braintree, a service of PayPal, Inc.Payments | Merchant payments | Worldwide |
| OpenAI, L.L.C.AI | Language models, embeddings and image generation | United States |
| Anthropic, PBCAI | Claude language models, a provider merchants can choose | United States |
| Hangzhou DeepSeek AI Co., Ltd.AI | Language models, a provider merchants can choose | People's Republic of China |
| Google LLCAI | Gemini text to speech for spoken replies, and Gemini Nano on Android devices | United States |
| Apple Inc.AI | Apple's on-device language models on iPhone | On the device |
| PhotoRoom SASAI | Background removal and product image editing on the images you upload | France, European Union |
| CopilotKit, Inc.AI | The in-product AI assistant, on CopilotKit Cloud | United States |
| Twilio SendGrid, part of Twilio Inc.Messaging | Transactional email: account, billing, sign-in links and password resets | United States |
| Resend, Inc.Messaging | A second transactional email service | United States |
| Vonage Holdings Corp.Messaging | SMS for sign-in security, service messages and merchant messages sent through the platform | Worldwide |
| Twilio Inc.Messaging | SMS and messaging delivery, and sender registration with US carriers | Worldwide |
| Google LLC, Firebase Cloud MessagingMessaging | Push notifications to the Android merchant app | United States and worldwide |
| Apple Inc., Apple Push Notification serviceMessaging | Push notifications to the iOS merchant app | United States and worldwide |
| Customer.io, Peaberry Software, Inc.Messaging | Marketing email, SMS, push and in-product messages, and the record of marketing consent; never transactional messages | United States, with an EU location in Frankfurt planned |
| Sentry, Functional Software, Inc.Operations | Error tracking and performance monitoring | United States |
| Liveblocks Inc.Operations | Real-time collaboration in the admin and store apps | United States |
| Canva Pty LtdOperations | Design tools inside the admin | Australia and worldwide |
| HubSpot, Inc.Operations | Sales contacts from the website contact and demo form | United States and worldwide |
| Slack Technologies, LLCOperations | Tells our sales team about a new lead from the website contact and demo form | United States and worldwide |
| Google LLC, Google Maps PlatformOperations | Address suggestions in merchant and storefront forms | United States and worldwide |
| PostHog, Inc.Analytics | Product analytics for our web apps | United States |
| Google LLC, Google Analytics for FirebaseAnalytics | Usage analytics in the mobile app | United States and worldwide |
| Google LLC, Google AdsAdvertising | Measuring our own ads in the mobile app | United States and worldwide |
| Google LLCSign-in | Sign in with Google | United States and worldwide |
| Apple Inc.Sign-in | Sign in with Apple | United States and worldwide |
| Meta Platforms, Inc.Sign-in | Continue with Facebook sign-in | United States and worldwide |
| Unsplash Inc.Content | Stock photos in the mobile app | Canada and worldwide |
| Pexels GmbHContent | Stock photos in the mobile app | Germany and worldwide |
Recipients that are not subprocessors
These companies receive data from us but decide for themselves how they use it, so they act as independent controllers, not on our instructions. The notice and objection rights below do not apply to them.
The advertising platforms measure our own ads, and those events are switched off today. When they are on, a platform receives a conversion event only when the visitor has agreed to advertising use of their data, never with a phone number, and not at all after a Do Not Sell or Share choice or a Global Privacy Control signal. The domain registrar receives the details it needs to register a domain.
| Recipient | What it does for us | Where |
|---|---|---|
| Namecheap, Inc.Operations | Registers, renews and transfers the domain names merchants buy through Tanqory, as the registrar of record | United States |
| Meta Platforms, Inc.Advertising | Conversion events that measure our own Meta ads | United States and worldwide |
| Google LLCAdvertising | Conversion events that measure our own Google ads | United States and worldwide |
| LinkedIn CorporationAdvertising | Conversion events that measure our own LinkedIn ads | United States and worldwide |
| TikTokAdvertising | Conversion events that measure our own TikTok ads | United States and worldwide |
| OpenAIAdvertising | Conversion events that measure our own ChatGPT ads | United States and worldwide |
When the list changes
We give 30 days' notice before a new subprocessor starts processing personal data. A merchant may object in that window by writing to legal@tanqory.com; the DPA sets out what happens next.
We also keep track of 14 providers that are not on this list: 7 tools only our own team uses, 5 named in older documents that we never connected, 1 we stopped using and 1 we are still evaluating. The last three process no personal data for us; a provider joins the list, with notice, before it starts.
Policies and documents
Questions
Does every subprocessor have a signed DPA with Tanqory?
Not yet. Signed agreements are recorded for some providers but not all, and our register records which are signed.
Why is DeepSeek on the list?
It is one of the AI models a merchant can choose for the assistant. It processes data in the People's Republic of China, where China's data-transfer rules apply. No transfer safeguard is in place for it yet and our review of those rules is not finished, so a merchant should choose it only after agreeing to that transfer.
Still have a question?
For anything this page does not answer, write to privacy@tanqory.com.
More in the trust center
Found a security issue?
Write to security@tanqory.com with the steps to reproduce it. We acknowledge every report within 24 business hours, keep you posted while we fix it, and never take legal action against research done in good faith under our disclosure policy.