These are the third parties that process personal data on our behalf to run the BeyondReviews service, as authorised by section 5 of the Data Processing Addendum. Each is bound by a data processing agreement with safeguards equivalent to the DPA, including Standard Contractual Clauses or Data Privacy Framework certification for transfers outside the EU/EEA.
Service subprocessors
These process merchant and customer data as part of operating the App. App data is stored and processed in the European Union, encrypted at rest and in transit.
| Subprocessor | Purpose | Data received | Location |
|---|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd.) | Application hosting and infrastructure, database (Spanner), and AI processing of review text to draft suggested replies (Vertex AI; not used to train models, and not retained: we hold an approved exception to Google's prompt logging policy for this project) | All service data described in the DPA Annex | European Union |
| Shopify International Ltd. / Shopify Inc. | E-commerce platform the App runs on; source of store, customer, and order data; billing | Platform data it already holds as the merchant's own processor | Canada, EU, US |
| Resend, Inc. | Delivery of review request and transactional emails | The recipient's email address only | United States; Standard Contractual Clauses |
Website and email vendors
These process data about visitors to beyondreviews.app only, never merchant customer data from the App. Details and opt-outs are in the Cookie Policy.
| Vendor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, content delivery, security, and the support contact form | Global network; EU and US data centres. DPF certified |
| Brevo (Sendinblue SAS) | Website email: single emails such as a scan readout, the newsletter, and notifications to us about sign-ups and the support form | European Union (France, Germany) |
| Loops (Loops, Inc.) | Emails to people who joined our waitlist: the welcome, short news, and the note when we open, with open and click counts | United States |
| Google Workspace (Google Ireland Ltd.) | Our own email (the hello@ and simon@ addresses) | EU, US. DPF certified |
| Anthropic, PBC | Claude, which drafts our answers to people who write to us | United States |
| Google Ireland Ltd. | Website analytics (Google Analytics 4 via Tag Manager), loaded only after cookie consent | EU, US. DPF certified |
| Microsoft Ireland Operations Ltd. | Website usage analysis (Clarity heatmaps and session replays, with text masked), loaded only after cookie consent | EU, US. DPF certified |
Changes to this list
We update this page at least 14 days before adding or replacing a service subprocessor. To be notified of changes by email, write "subscribe subprocessors" to [email protected]. The objection process is described in section 5 of the DPA.