These are the third parties that process personal data on our behalf to run the BeyondReviews service, as authorised by section 5 of the Data Processing Addendum. Each is bound by a data processing agreement with safeguards equivalent to the DPA, including Standard Contractual Clauses or Data Privacy Framework certification for transfers outside the EU/EEA.
Service subprocessors
These process merchant and customer data as part of operating the App. App data is stored and processed in the European Union, encrypted at rest and in transit.
| Subprocessor | Purpose | Data received | Location |
|---|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd.) | Application hosting and infrastructure, database (Spanner), and AI processing of review text to draft suggested replies (Vertex AI; not used to train models, and not retained: we hold an approved exception to Google's prompt logging policy for this project) | All service data described in the DPA Annex | European Union |
| Shopify International Ltd. / Shopify Inc. | E-commerce platform the App runs on; source of store, customer, and order data; billing | Platform data it already holds as the merchant's own processor | Canada, EU, US |
| Resend, Inc. | Delivery of review request and transactional emails | The recipient's email address only | United States; Standard Contractual Clauses |
Website-only vendors
These process data about visitors to beyondreviews.app only, never merchant customer data from the App. Details and opt-outs are in the Cookie Policy.
| Vendor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, content delivery, security, and the support contact form | Global network; EU and US data centres. DPF certified |
| Brevo (Sendinblue SAS) | Website email: early access list, newsletter, and support form notifications | European Union (France, Germany) |
| Google Ireland Ltd. | Website analytics (Google Analytics 4 via Tag Manager), loaded only after cookie consent | EU, US. DPF certified |
| Microsoft Ireland Operations Ltd. | Website usage analysis (Clarity heatmaps and session replays, with text masked), loaded only after cookie consent | EU, US. DPF certified |
Changes to this list
We update this page at least 14 days before adding or replacing a service subprocessor. To be notified of changes by email, write "subscribe subprocessors" to [email protected]. The objection process is described in section 5 of the DPA.