Current sub-processors
This list reflects the sub-processors in use as of the date above. It is the authoritative list referenced by our DPA and Privacy Policy.
| Sub-processor | Purpose | Personal data shared |
|---|---|---|
| Clerk | Authentication and session management | Account identity (email, name), authentication metadata |
| Stripe (incl. Stripe Connect and Express) | Subscription billing, conversion and refund webhooks, and affiliate payouts | Billing details, payout identity and bank details, affiliate tax forms (held by Stripe), customer and conversion data |
| Paddle | Conversion and refund tracking for brands that connect their own Paddle Billing account | Customer and order identifiers and sale and refund amounts received from the brand’s Paddle account; the brand’s Paddle credentials are stored encrypted at rest |
| Braintree (a PayPal company) | Subscription conversion and chargeback tracking for brands that connect their own Braintree account | Customer and transaction identifiers and recurring sale and dispute amounts received from the brand’s Braintree account; the brand’s Braintree API credentials are stored encrypted at rest |
| Shopify (rolling out) | For merchants who install the Rekomi app for Shopify: order and refund conversion tracking, affiliate discount-code management, and billing for the merchant’s Rekomi subscription and commission fee through Shopify (Shopify is both a sub-processor and the biller of record for those merchants). Not yet processing for installed stores. | When live: shop domain, order and customer identifiers, and sale and refund amounts received from the merchant’s Shopify store; the store’s offline Admin API access token is stored encrypted at rest. Protected customer data is handled under Shopify’s Protected Customer Data requirements. |
| Lemon Squeezy (a Stripe company) | Merchant-of-record billing data for brands who connect their own Lemon Squeezy store: order, subscription renewal, and refund conversion tracking | Customer and order identifiers and sale, renewal, and refund amounts received from the brand’s Lemon Squeezy store; the brand’s Lemon Squeezy API key and webhook signing secret are stored encrypted at rest |
| Chargebee | Subscription billing data for brands who connect their own Chargebee site: payment, renewal, and refund conversion tracking | Customer, subscription, and invoice identifiers and payment, renewal, and refund amounts received from the brand’s Chargebee site; the brand’s read-only Chargebee API key and the webhook credential are stored encrypted at rest |
| Polar | Merchant-of-record billing data for brands who connect their own Polar organization: order, subscription renewal, and refund conversion tracking | Customer and order identifiers and sale, renewal, and refund amounts received from the brand’s Polar organization; the brand’s Polar access token and webhook signing secret are stored encrypted at rest |
| Recurly, Inc. | Subscription billing data for brands who connect their own Recurly site: paid invoice, renewal, and refund conversion tracking | Customer, subscription, invoice, and transaction identifiers and payment, renewal, and refund amounts received from the brand’s Recurly site, plus subscription and account custom-field referral values read via the brand’s API key; the brand’s read-only Recurly API key and the webhook credential are stored encrypted at rest |
| Gumroad, Inc. | Merchant-of-record commerce data for brands who connect their own Gumroad seller account: sale, membership renewal, refund, dispute, and membership lifecycle conversion tracking | Buyer email and name, sale, product, and subscription identifiers, and sale, refund, and dispute amounts received from (and read back against) the brand’s Gumroad account; the brand’s Gumroad access token is stored encrypted at rest |
| Armitage Labs OU (Creem) | Merchant-of-record commerce data for brands who connect their own Creem store: sale, subscription renewal, refund, dispute, and subscription lifecycle conversion tracking | Customer email and name, product, order, subscription, and transaction identifiers and amounts received from the brand’s Creem store; the brand’s Creem API key and webhook signing secret are stored encrypted at rest |
| Dodo Payments Inc | Merchant-of-record commerce data for brands who connect their own Dodo Payments account: payment, subscription renewal, refund, dispute, and subscription lifecycle conversion tracking | Customer email and name, business, product, payment, subscription, refund, and dispute identifiers and amounts received from the brand’s Dodo Payments account; the brand’s Dodo Payments API key and webhook signing secret are stored encrypted at rest |
| PayPal | Affiliate payout rail for countries Stripe Express does not cover | Affiliate PayPal email and payout amounts |
| Resend | Transactional and lifecycle email delivery | Recipient email address and message content |
| Cloudflare | DNS, CDN, edge tracking, bot detection, and custom tracking and portal hostnames | Request metadata, IP address, user agent, bot score |
| DigitalOcean | Application hosting and private object storage (Spaces) for uploaded files such as affiliate tax forms | Uploaded documents (for example W-8 tax forms) and application data in transit through hosting |
| Managed PostgreSQL and Redis | Primary application database and cache | All application data, including account, affiliate, conversion, and payout records |
| Sentry | Error and performance monitoring | Diagnostic data, scrubbed of personal data before transmission where feasible; IP and user agent |
| PostHog (opt-in) | Product analytics, enabled only with analytics-cookie consent | Usage events and device or session identifiers |
| Google Analytics 4 (opt-in) | Aggregate traffic and marketing attribution, enabled only with analytics-cookie consent | Aggregate usage and traffic data; IP addresses are anonymized by Google before storage |
| Intercom (opt-in) | Support chat, loaded only with marketing-cookie consent | Support conversation content and contact details you provide |
| Anthropic (opt-in) | AI features (Claude), enabled per organization | The content you submit to an AI feature; not used to train models without your consent |
Data residency
Our default processing region is the United States. Sub-processors may operate globally; where personal data is transferred out of the EEA or UK, our DPA relies on Standard Contractual Clauses and the UK International Data Transfer Addendum.
Changes
We give customers advance notice before we add or replace a sub-processor that processes personal data, and the “Updated” date above reflects the current list. To raise a concern about a sub-processor, contact support@rekomi.com.