Our sub-processors
Each sub-processor has a written agreement with us that protects personal data at least as well as our Data Processing Agreement with you.
| Sub-processor | Task | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| UpCloud Ltd (Finland) | Server, database and nightly backups on encrypted disks in UpCloud's Stockholm data centre. | Everything Storeassist stores. | Sweden (EU) | Processed inside the EU/EEA. |
| Cloudflare, Inc. (USA) | R2 storage for uploaded files (supplier portal, imports), bookkeeping documents, shipping labels, workshop photos and signatures, payroll exports, customer exports and stored B2B storefront images, and for an off-site copy of the nightly backups. Cloudflare also runs DNS for storeassist.io, but no traffic passes through Cloudflare. | The files can contain suppliers' contact details, customer data in bookkeeping documents, proformas, shipping labels and workshop photos, employees' data in payroll exports, and payout files. Cloudflare encrypts them at rest, but not with our own key. Backups are encrypted on our server before they leave it, and Cloudflare does not hold the key. DNS handles no personal data. | EU (R2 storage) | EU Standard Contractual Clauses and the EU–US Data Privacy Framework. |
| Resend (Plus Five Five, Inc., USA) | Sends Storeassist's email: sign-in codes, invitations, notices, email in the store's name and support replies. Receives email sent to our support address. No open or click tracking. | The recipient's email address and the message's subject and body. For email to support: the sender's address, name, message and attachments. | Ireland (EU) | EU Standard Contractual Clauses. |
| Anthropic (Anthropic PBC, USA) | Generates answers in the support chat and drafts replies for our staff. | Chat messages and what is written in them and, when you allow it, your store's settings, error codes and order references the assistant looks up. Not used to train models; the provider deletes the data within 30 days. | USA | EU Standard Contractual Clauses and the EU–US Data Privacy Framework. |
| 46elks AB (Sweden) | Sends text messages: workshop notifications to customers and notices to employees, and returns delivery reports. | The recipient's phone number, the sender name and the message text. | Sweden (EU) | Processed inside the EU/EEA. |
| Expo (650 Industries, Inc., USA) | Delivers push notifications to the mobile app through Apple and Google. | The device's push token and the notification's title and text, for example about a shift. | USA | EU–US Data Privacy Framework. |
Services you connect yourself
You choose these services and have your own agreements with them. Storeassist sends data to them only because you connected the service or turned the feature on. That makes them not our sub-processors, but we list them so you can see where data goes.
| Service | What Storeassist does | Personal data | Location |
|---|---|---|---|
| Shopify | Reads and writes orders, customers, products, stock and payouts in your store through Shopify's API. | Your customers' names, contact details, addresses and orders. | Under your agreement with Shopify |
| Fortnox AB (Sweden) | Creates customers, invoices, credit notes and vouchers in your Fortnox once you connect Fortnox. With the Staff module it can also read employees from and send payroll data to Fortnox Lön. | The customer's name, address, email, company registration number, and order and invoice lines. For Fortnox Lön: employees' names, personal ID numbers and hours. | Sweden |
| Spiris, formerly Visma eEkonomi (Sweden) | Creates customers, invoices, credit notes and vouchers in your Spiris once you connect Spiris. | The customer's name, address, email, company registration number, and order and invoice lines. | Sweden |
| Sendify and Shipmondo | Gets freight prices, books shipments and fetches labels and tracking once you add your own API key. | The receiver's name, address, phone and email, the sender's details, and parcel and order references. For freight prices at checkout: the delivery address. | Under your agreement with the carrier |
| PostNord, DHL Freight, Bring and nShift | The same as above, once we have turned the carrier on for your store. They are off by default and book on your own customer number with the carrier. | The receiver's name, address, phone and email, the sender's details, and parcel and order references. For freight prices at checkout: the delivery address. | Under your agreement with the carrier |
Open map and address services
The address search and the map in the freight calculator use open map and address services. We have no data processing agreement of our own with them. They receive only what you search for or the point you click, and no customer or order IDs. So don't type a customer's name in the search field.
| Service | What Storeassist does | Personal data | Location |
|---|---|---|---|
| Photon (komoot GmbH) | Searches addresses as you type. Our server makes the call. | The search text, which can be a customer's address. | Germany (EU) |
| Nominatim (OpenStreetMap Foundation) | Finds the address of a point you click. Our server makes the call. | The point's coordinates, which can be a customer's address. | United Kingdom |
| Map images from OpenStreetMap (OpenStreetMap Foundation) | Your browser fetches the map images directly. | Your IP address and browser details. | United Kingdom |
How we announce changes
Before we add or replace a sub-processor, we email the store owner at least 30 days in advance and update this page. If you have a reasoned objection, email us at support@storeassist.io before the change takes effect. If we can't resolve the objection, you may end the agreement before the change takes effect.
Change log: 2026-11-07, added 46elks and Expo, listed carriers and open map services, removed Google Fonts. 2026-10-25, added Anthropic; Resend now also receives email to support. 2026-10-23, first version.