In short
- These are the companies that help us run Axcoda and may process personal data on your behalf.
- Data about your shop is stored in the European Union. Notification channels you switch on (Telegram, browser push) receive the messages you choose to get.
- We tell you at least 14 days before adding or replacing a subprocessor, and you can object.
What is a subprocessor? #
When you use Axcoda Guard, you are the controller of the data about your shop, its orders and your buyers, and we are your processor (Data Processing Agreement). A subprocessor is a company we engage to help us provide the service and which may get access to that data.
TikTok is not on this list. TikTok Shop is the platform where your shop runs and where the data comes from; you connect it yourself, and its own terms apply.
Current subprocessors #
| Company | What it does for us | Data it processes | Where | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH, Gunzenhausen, Germany | Servers, databases and backups that run Axcoda | All service data: account, recipients (encrypted addresses), shop data, logs | Germany (EU) | Inside the EU |
| Cloudflare, Inc., USA | DNS, delivery of the axcoda.com website, forwarding of email sent to our @axcoda.com addresses | IP addresses and request details of website visitors; content of emails you send us | Global network | EU–US Data Privacy Framework; Standard Contractual Clauses (2021/914) in Cloudflare’s DPA |
| Sendinblue SAS (Brevo), Paris, France | Sending sign-in links, invitations, alerts and digests by email | Recipient email address, message text | EU | Inside the EU |
| Telegram Messenger Inc. | Delivering alerts to the Telegram chats you connect | Telegram chat ID, alert text, Telegram name of the person who taps a button | According to Telegram, data of EEA users is stored in the Netherlands; the company and its group are outside the EEA | No adequacy decision; used only when you add a Telegram recipient — see the Privacy Policy |
| Google LLC (Firebase Cloud Messaging), USA | Delivering browser push notifications to Chrome, Edge on Android and other Chromium browsers | Push subscription address and an encrypted message it cannot read; size and time of the message | USA | EU–US Data Privacy Framework |
| Microsoft Corporation (Windows Push Notification Services), USA | Delivering browser push notifications to Edge on Windows | Same as above | USA | EU–US Data Privacy Framework |
| Apple Inc. (Apple Push Notification service), USA | Delivering browser push notifications to Safari on macOS and iOS | Same as above | USA | Not certified under the Data Privacy Framework; the message is end-to-end encrypted and the service is chosen by your browser |
| Mozilla Corporation (Mozilla Push Service), USA | Delivering browser push notifications to Firefox | Same as above | USA | Not certified under the Data Privacy Framework; the message is end-to-end encrypted and the service is chosen by your browser |
Telegram and browser push are used only when you add such a recipient yourself. If you use only email, they receive nothing about you.
Payments #
Paid plans are sold through Paddle.com Market Ltd (London, United Kingdom), our reseller (Merchant of Record). Paddle processes payment and billing details as an independent controller under its own privacy policy, not as our subprocessor. The United Kingdom is covered by an EU adequacy decision.
Planned subprocessors #
Not used yet. We will add it to the table above, with notice, before it processes any data:
- Meta Platforms Ireland Ltd (WhatsApp) — if WhatsApp alerts are introduced.
What is not a subprocessor #
- GitHub — we keep our source code there; it holds no customer data.
- Have I Been Pwned (Pwned Passwords) — if you set a password, we check whether it appeared in known leaks by sending only the first 5 characters of its hash. Neither the password nor your email leaves our servers.
How you learn about changes #
We update this page and email the owners of all accounts at least 14 days before a new subprocessor starts processing data. If you have a reasonable data-protection objection, write to [email protected] within that period; the procedure is described in the DPA.
To get these notices even without an account (for example, as a lawyer or a data protection officer), write to [email protected] with the subject “Subprocessor updates”.
Questions about your data: [email protected]