Legal
Subprocessors
Third parties that process personal data on our behalf. We give 30 days' notice before adding one.
Draft, last updated 2026-10-10. The operating company is being incorporated; every [ENTITY — D-006 pending] placeholder will be replaced with the registered details before launch, after counsel review.
Current list (draft; accounts not yet opened are marked planned)
- Whop, Inc. (USA) — payment processing, KYC, merchant of record; buyer payment and order data. Transfer mechanism: Standard Contractual Clauses. Status: planned (platform account pending D-006).
- Vercel Inc. (USA; app hosted in Frankfurt, fra1) — application hosting, request logs. SCCs. Status: planned.
- EU Postgres provider (Supabase eu-central-1 or Neon Frankfurt; to be chosen) — primary database in the EU. Status: planned.
- Resend (USA; EU region) — transactional email (sign-in links, invitations, order confirmations). SCCs. Status: planned.
- PostHog (EU cloud, Frankfurt) — product analytics on this website and the dashboard, only with consent. Status: planned.
- Sentry (EU region) — error reports (may include request metadata). Status: planned.
- Cloudflare, Inc. (global; EU jurisdiction for storage) — DNS, TLS, custom checkout domains, file storage. SCCs. Status: planned.
- Shopify International Ltd. (Ireland) — only when the Merchant connects a Shopify store; order and product data flow both ways under the Merchant's Shopify agreement.
Changes
Merchants can subscribe to change notices by emailing hello@snailcart.com. Objections to a new subprocessor may be raised within 30 days; if we cannot resolve them, the Merchant may terminate the affected service.
Questions: hello@snailcart.com