Sub-processors
Last updated 17 October 2026. Third parties that process customer data on Growstall's behalf. We email account holders 30 days before adding or replacing one.
| Provider | Purpose | Location | Data |
|---|---|---|---|
| Supabase, Inc. | Database, authentication and sign-in emails | United Kingdom (AWS eu-west-2, London) | All stored data, encrypted at rest; account emails |
| Vercel, Inc. | Application hosting, serverless functions, scheduled sync, request logs | United Kingdom (London region) for application processing; global edge network for TLS termination and static assets | Data in transit through the application; request metadata in logs for up to 30 days |
| Google LLC | Gemini API: translation, acknowledgement localisation, reply drafts, complaint summaries | United States | Redacted message text and minimal order context (status, carrier, item names). Only while the Controller keeps AI features enabled; Google does not train on API data |
| TypeSafe, Inc. (System One) | Typed judgements: issue category, what a complaint is about and how it ended, return reason, ERP reason codes | United States | Redacted message text and order status. Only while the Controller keeps classification enabled; no training on inputs |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Subscriptions, invoices, card payments, VAT | Ireland and United States | Account holder name, e-mail, billing address, VAT number, payment card (held by Stripe only), invoice history. No marketplace data |
| Resend, Inc. | Outbound e-mail: notifications, summaries, account mails, and the replies sent on the Amazon and OTTO channels | European Union (AWS eu-west-1, Ireland) for sending; company in the United States | Recipient address and the content of each e-mail, including customer replies and their attachments on the Amazon and OTTO channels; delivery logs |
| ActiveCampaign, LLC (Postmark) | Inbound e-mail for the Amazon and OTTO channels (the <token>@in.growstall.com addresses) | United States | The full inbound e-mail: customer message text, sender address, attachments; kept by Postmark for 45 days, then only in Growstall |
| Ship24 SAS | Parcel tracking status and proof of delivery for orders with a conversation | France (European Union) | Tracking number, carrier, destination postcode and country; the carrier's scan history and proof-of-delivery document |
| Telegram FZ-LLC | Alert delivery when the Controller connects a Telegram bot (optional) | United Arab Emirates / Netherlands | Alert text: conversation subject, marketplace, SLA state, product alert summaries. Only for workspaces that connect a bot |
| Google LLC (Google Analytics 4) | Website and app usage statistics (page views, sign-ups, subscriptions), with IP anonymisation and Consent Mode; analytics cookies only after consent | United States (Google Analytics servers; EU data transfers covered by the EU-US Data Privacy Framework and standard contractual clauses) | Pseudonymous usage data: pages viewed, events, browser and device class, truncated IP. No marketplace messages, no customer data. |
Not sub-processors
The marketplace operators (B&Q, Argos, Debenhams, The Range, Home24 and others) are independent controllers with their own agreements with you. Growstall reads from and writes to your seller account there on your instruction; nothing about that relationship changes.
Mirakl SA provides the platform those marketplaces run on. Growstall has no contract with Mirakl and sends it nothing beyond the API calls made with your own key.
Amazon (Seller Central) and OTTO (Partner Connect) forward customer messages to your Growstall address on your instruction and receive your replies; they remain independent controllers. Where a Controller connects its own mailbox (IMAP/SMTP) or its own ERP, that provider acts for the Controller, not for Growstall.