1. Current subprocessors
A subprocessor is a service provider that processes personal data on our behalf. For data from your Shopify store, you are the controller and CheckoutLeak is your processor, as set out in our Data Processing Addendum. Each provider below processes data only to provide its service to us, under its agreement with us.
| PROVIDER | PURPOSE | DATA INVOLVED | LOCATION |
|---|---|---|---|
| Vercel | Hosting the app and the website | Store data the app processes while handling a request; standard request data (such as IP address, browser and page) for the website and the waitlist form | App functions: Dublin, Ireland. Website: global edge network |
| Supabase | Production database (PostgreSQL) | Everything the app stores: shop record and Shopify access token, settings, scan results, daily totals and counters, the audit trail and waitlist sign-ups | London, UK |
| Trigger.dev | Background jobs: scheduled scans, order totals, alerts, the weekly summary and maintenance | Store data processed while a job runs; job records contain IDs, not customer data | Provider’s infrastructure, which may include the United States |
| OpenRouter | Routes optional AI suggestion requests to a model provider | Product images and text, and the numbers in your weekly summary. No customer data | Provider’s infrastructure, which may include the United States |
| Model provider selected by OpenRouter | Writes optional AI suggestions. Only providers that do not store request data or train on it are used. Our default models are Anthropic’s Claude models | Same as OpenRouter | Provider’s infrastructure, which may include the United States |
| Resend | Sending email: weekly summary, alerts and waitlist emails | Recipient email address (your store’s owner email, or a waitlist address) and the email’s content, such as store name, discount names and figures | Provider’s infrastructure, which may include the United States |
AI suggestions are off unless you use them. Storefront insights data stays with Vercel and Supabase and is not sent to the AI providers.
2. Shopify and Slack
Shopify is the platform CheckoutLeak runs on and the source of the store data it reads, with the permissions you approve. Shopify also handles app installation and billing. It is not a subprocessor in the usual sense: you have your own agreement with Shopify, and Shopify processes your store data as part of the service it provides to you.
Slack is used only if you add a Slack incoming-webhook URL for alerts. Alerts are then delivered to your Slack workspace under your own agreement with Slack.
3. Where data is processed
Our production database is in London (UK) and our app functions run in Dublin (Ireland). Some providers may process data in other countries, including the United States. Where personal data leaves the EEA or the UK, we rely on an adequacy decision or on safeguards such as the EU Standard Contractual Clauses (with the UK addendum where UK law applies).
4. How we announce changes
When we add or replace a subprocessor, we update this page and the date above. Where a change is material for merchant data and our Data Processing Addendum or the law requires it, we also email merchants, at their store’s owner email, before the change takes effect. Merchants can object as described in the addendum.
5. Contact
Questions about our subprocessors: privacy@checkoutleak.com. See also our privacy policy and security page.