01About This List
A subprocessor is a third party engaged by Astrixy that may process personal data on behalf of our customers. This page is the authoritative list referenced by section 7 of the Data Processing Agreement. Each entry is bound by a written agreement imposing data protection obligations no less protective than our own commitments to you.
02Current Subprocessors
| Provider | Purpose | Data Processed | Region |
|---|---|---|---|
| Supabase (Lovable Cloud) | Primary database, authentication, object storage, and serverless functions | All tenant application data, account credentials, uploaded media | European Union / United States |
| Cloudflare | DNS, CDN, TLS termination, DDoS mitigation, and WAF | IP addresses, request metadata, cached public assets | Global edge network |
| Dodo Payments | SaaS subscription billing, invoicing, and merchant-of-record tax handling | Name, email, billing address, country, payment instrument (held by provider) | United States / India |
| Stripe | Merchant-owned checkout processing and payout rails | Buyer name, email, billing address, payment instrument (held by provider) | United States / European Union |
| PayPal | Alternative merchant checkout processing | Buyer name, email, transaction amount | United States / European Union |
| CJ Dropshipping | Product sourcing, order fulfilment, and shipment tracking | Recipient name, shipping address, phone number, order line items | China / Global warehouses |
| Resend | Transactional and notification email delivery | Recipient email address, message content, delivery events | United States / European Union |
| Google (Analytics, Search Console, Gemini API) | Product analytics, search performance, and AI generation features | Anonymised usage events, truncated IP address, prompt content | United States / European Union |
| Meta Platforms | Instagram catalogue sync and advertising conversion measurement | Catalogue data, hashed conversion identifiers where consent is given | United States / European Union |
| TikTok for Business | Advertising conversion measurement | Hashed conversion identifiers where consent is given | United States / European Union / Singapore |
03Merchant-Configured Integrations
When you connect your own accounts — your Stripe account, your ad platforms, your email provider, your courier — that provider becomes a subprocessor of your business, engaged under your own agreement with them, not ours. Astrixy transmits data to those endpoints on your instruction. Review the connections listed in your dashboard before publishing a storefront.
04Change Notifications
We publish additions and replacements here at least 30 days before they take effect. To receive email notice, send a request to dpo@astrixy.app with the subject line "Subprocessor notifications". Objection rights are described in the DPA.
05Questions
Data Protection Officer: dpo@astrixy.app