We use the following sub-processors to deliver the Deltapp service. Each is bound by a data processing agreement. We notify customers at least 14 days before adding a new sub-processor that materially affects personal data handling.
| Sub-processor | Purpose | Data category | Location | Transfer safeguard |
|---|---|---|---|---|
| Clerk | Authentication and account management | Account credentials, sessions | US | Standard Contractual Clauses + DPA |
| Vercel | Application hosting (web frontend + serverless functions) | Requests, logs, metadata | US (compute), Global (CDN) | Standard Contractual Clauses + DPA |
| Oracle Cloud Infrastructure | Primary database hosting (Postgres) | Account data, listings, orders | UK | UK adequacy decision (EU-to-UK transfer) |
| Trigger.dev | Scheduled job runner (price syncs, scheduled publishes) | Job metadata, user IDs | UK | DPA in ToS (API Hero Ltd, UK) |
| Sentry | Error monitoring and performance tracing | Error stacks, request metadata, anonymous user IDs | EU | Within EU; DPA on file |
| Resend | Transactional email delivery | Email addresses, message content | US | Standard Contractual Clauses + DPA |
| Google Analytics | Marketing-site usage analytics (only with your consent) | Pseudonymous usage events, approximate location (IP not retained) | US | Standard Contractual Clauses + DPA; loads only on opt-in |
| Decodo | Amazon price scraping fallback | ASINs (no personal data) | EU | No personal data transferred |
| BrightData | Amazon price scraping (primary provider) | ASINs (no personal data) | Israel | No personal data transferred |
| SerpAPI | Amazon price + variant scraping | ASINs (no personal data) | US | No personal data transferred |
| RapidAPI | Amazon price scraping (fallback) | ASINs (no personal data) | US | No personal data transferred |
| scrape.do | Amazon page fetching (fallback) | ASINs (no personal data) | US (PACKEND, LLC) | No personal data transferred |
| Cloudflare | Edge proxy for Amazon page fetches | Request metadata (no personal data) | Global (edge) | No personal data transferred |
| TrackTaco | Proof-of-delivery tracking number generation (optional, off by default) | Destination city/state/country + date filters (no name or address) | US | No buyer personal data transferred |
| eBay | Marketplace integration (listings, orders, messages) | Store-level data you connect via OAuth | Global | eBay platform DPA |
| Amazon | Product source (read-only product data) | ASINs (no personal data) | Global | No personal data transferred |
Where data leaves the UK / EEA, transfers are protected by Standard Contractual Clauses, adequacy decisions, or the sub-processor's own approved transfer mechanism.