Our sub-processors
Each sub-processor has a written agreement with us that protects personal data at least as well as our Data Processing Agreement with you.
| Sub-processor | Task | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| UpCloud Ltd (Finland) | Server, database and nightly backups on encrypted disks in UpCloud's Stockholm data centre. | Everything Storeassist stores. | Sweden (EU) | Processed inside the EU/EEA. |
| Cloudflare, Inc. (USA) | R2 storage for uploaded files (supplier portal, imports), bookkeeping documents and B2B storefront images, and for an off-site copy of the nightly backups. Cloudflare also runs DNS for storeassist.io, but no traffic passes through Cloudflare. | The files can contain suppliers' contact details, customer data in bookkeeping documents and proformas, and payout files. Cloudflare encrypts them at rest, but not with our own key. Backups are encrypted on our server before they leave it, and Cloudflare does not hold the key. DNS handles no personal data. | EU (R2 storage) | EU Standard Contractual Clauses and the EU–US Data Privacy Framework. |
| Resend (Plus Five Five, Inc., USA) | Sends Storeassist's email: sign-in codes, invitations, notices and B2B email. No open or click tracking. | The recipient's email address and the message's subject and body. | Ireland (EU) | EU Standard Contractual Clauses. |
Services you connect yourself
You choose these services and have your own agreements with them. Storeassist sends data to them only because you connected the service or turned the feature on. That makes them not our sub-processors, but we list them so you can see where data goes.
| Service | What Storeassist does | Personal data | Location |
|---|---|---|---|
| Shopify | Reads and writes orders, customers, products, stock and payouts in your store through Shopify's API. | Your customers' names, contact details, addresses and orders. | Under your agreement with Shopify |
| Fortnox AB (Sweden) | Creates customers, invoices, credit notes and vouchers in your Fortnox once you connect Fortnox. | The customer's name, address, email, company registration number, and order and invoice lines. | Sweden |
| Visma eEkonomi / Spiris (Sweden) | The same as for Fortnox, once you connect Visma eEkonomi. | The customer's name, address, email, company registration number, and order and invoice lines. | Sweden |
| Google Fonts (Google Ireland Ltd) | Only if you pick a Google font for a B2B storefront: the buyer's browser loads the font from Google. | The buyer's IP address and browser details. | EU and USA (EU–US Data Privacy Framework) |
How we announce changes
Before we add or replace a sub-processor, we email the store owner at least 30 days in advance and update this page. If you have a reasoned objection, email us at [kontakt@storeassist.io] before the change takes effect. If we can't resolve the objection, you may end the agreement before the change takes effect.
Change log: 2026-10-23, first version.