Sub-processors
These are the sub-processors Price Fusion uses to provide its service to merchants. This list is Part A of Annex 3 of our Data Processing Agreement. We give merchants at least 30 days' notice before adding or replacing a sub-processor, by email and by updating this page, except where a replacement is needed urgently to keep the service secure or available, when we give notice as soon as we reasonably can.
| Name | Purpose | Merchant Personal Data processed | Location | Transfer Mechanism | Retention |
|---|---|---|---|---|---|
| Vercel Inc. (US) | Application hosting and functions; runtime logs | All Merchant Personal Data in transit, including Shoppers' IP addresses and user agents on pixel requests | Functions: London. Logs: may be held outside the UK, including in the United States | EU SCCs with the UK Addendum, or the IDTA, in Vercel's published data processing addendum | Runtime logs: the short period set by Vercel's plan |
| Neon (US) | Postgres database, backups and point-in-time restore | All stored Merchant Personal Data | AWS eu-west-2 (London) | For any access from the US: EU SCCs with the UK Addendum, in Neon's published data processing addendum | Restore history: 7 days |
| Upstash, Inc. (US) | Redis cache: OAuth state, webhook de-duplication, rate limiting | Shop domains; webhook ids; caller IP addresses used as rate-limit keys (short-lived) | AWS eu-west-2 (London) | For any access from the US: EU SCCs with the UK Addendum, in Upstash's published data processing addendum | Until the entries expire (1 minute to 24 hours) |
| Inngest Inc (US) | Background job queue and event history | Pixel events, minimised as in Annex 1; Compliance Webhook events carrying the shop domain, the Shopify customer id (a pseudonymous Shopper identifier), order ids and the data-request id; other Shopify webhook bodies reduced to ids, plus variant prices and their timestamps (product updates) and stock levels (inventory updates); no Shopper or store-owner contact details | United States | Inngest DPA with the EU SCCs and the UK Addendum, signed 15 Oct 2026; transfer risk assessment to be documented before the first merchant (clause 3.4). Inngest holds a SOC 2 Type II report | Event history: the period set by Inngest's plan |
| Anthropic (US) | AI model provider for insights and strategy | Shop domain, product, price, stock and sales figures, and Merchant free text; no Shopper fields | United States | EU SCCs with the UK Addendum, in Anthropic's Data Processing Addendum under its Commercial Terms | Inputs and outputs: a limited period under Anthropic's commercial data retention policy; zero data retention is not enabled. Anthropic does not use them to train its models |
| Sentry (Functional Software, Inc.; US) | Error monitoring, hosted in Sentry's EU data region, configured to send no personal data | Error events with personal data removed or redacted before sending | Sentry's EU data region; account and usage data in the US | EU SCCs with the UK Addendum in Sentry's Data Processing Addendum (v5.1.0, accepted 13 Oct 2026) | Error events: the period set by Sentry's plan |
| Google (Google Workspace) | Support email (support@pricefusion.ai) | Support correspondence, which may include Merchant Personal Data the Merchant sends | Google's data centres | Standard contractual clauses in Google's published Cloud Data Processing Addendum | Until Price Fusion deletes the email |
Support correspondence is Account Data, for which Price Fusion is controller. Google is listed here because a Merchant may include Merchant Personal Data in an email.
Shopify is the source of the data and the billing provider for the app. It is not a Sub-processor of Price Fusion; its own terms with the Merchant and with Price Fusion (as a Shopify Partner) apply.
AI assistants that the Merchant itself connects to Price Fusion are not Sub-processors; the Merchant chooses them and their providers act for the Merchant.