Subprocesadores

We use a small number of third-party services to operate the MarginLock platform. The table below lists every subprocessor that may process customer personal data on our behalf, along with the purpose, the categories of data, and the region where data is processed.

Vendor	Purpose	Data processed	Region	DPA
Amazon Web Services	Application database, worker compute, object storage, marketing site hosting	Customer Amazon Seller Central data, account metadata, warehouse measurement photos, IP addresses, request metadata	us-east-1 (USA)	AWS DPA
Resend	Transactional email (magic links, contact form, account notifications)	Email addresses, message bodies	USA	Resend DPA
Kit (ConvertKit)	Newsletter subscriptions	Email addresses	USA	Kit DPA
Upstash	Rate-limit state for forms and APIs	IP addresses	USA, EU regions	Upstash DPA
Anthropic	Vision analysis of warehouse measurement photos (scale readings, box dimensions)	Photos captured by warehouse users during shipment measurement	USA	Anthropic DPA
PostHog	Product analytics, session replay, feature flags, error tracking	Email addresses, IP addresses, device and usage metadata, user identifiers, session recordings	EU (PostHog Cloud EU)	PostHog DPA
iubenda	Cookie consent banner and consent management (CMP)	IP addresses, browser and referrer metadata, cookie consent preferences	EU (Italy)	iubenda DPA
Better Stack	Uptime + status page	Probe results	USA, EU regions	Better Stack DPA
Stripe	Subscription billing	Email addresses, billing addresses, payment metadata (no card numbers)	USA, EU regions	Stripe DPA

We notify customers in writing at least 30 days before adding or replacing a subprocessor. Customers may object to a new subprocessor under the terms of our DPA.