Subprocessors
Effective: 1.11.2026
This page lists every company that processes personal data on behalf of Quomerce. The list forms part of the Data Processing Agreement. We notify Account owners by e-mail at least 14 days in advance before adding or changing a subprocessor of your customers’ data.
1. Data of people visiting your shop
These entities process the data collected by the Quomerce script and the Quomerce apps for shop platforms (e.g. Shopify), that is, data for which you are the controller and we are the processor.
| Entity | What it does | Where the data is | Transfer basis |
|---|---|---|---|
| Railway Corporation (USA) | Hosting: the data collection service, the event database (ClickHouse), the application database (PostgreSQL), the API | EU — Netherlands (region europe-west4) | Data stored in the EU; access from the USA under standard contractual clauses |
| Cloudflare, Inc. (USA) | Content delivery network and attack protection in front of Quomerce’s services | Global network, nearest node | EU-US Data Privacy Framework, standard contractual clauses |
| Grafana Labs (USA) | Technical monitoring: metrics, logs and traces of how the services run, with no IP addresses and no event content | Europe | EU-US Data Privacy Framework, standard contractual clauses |
Data that you send yourself — to Slack, through webhooks, the API or to your own AI assistant connected through MCP — goes to the services you have chosen, on your instruction. Those services are not our subprocessors.
2. Data we are responsible for
These entities process data for which Quomerce is the controller: data of customers, application Users and people visiting our websites (details in the Privacy Policy).
| Entity | What it does | Where the data is | Transfer basis |
|---|---|---|---|
| Railway Corporation (USA) | Hosting the application and databases | EU — Netherlands | Standard contractual clauses |
| Cloudflare, Inc. (USA) | Hosting quomerce.com, app.quomerce.com and docs.quomerce.com; storing audit reports (R2) | EU (R2), global network | EU-US Data Privacy Framework, standard contractual clauses |
| Grafana Labs (USA) | Technical monitoring | Europe | EU-US Data Privacy Framework, standard contractual clauses |
| PostHog Inc. (USA) | Analytics of website and application use — after consent | EU (Frankfurt) | Data stored in the EU; standard contractual clauses |
| Google Ireland Limited | Tag manager (Google Tag Manager) on quomerce.com — after consent; fonts; demo booking calendar | EU / global | EU-US Data Privacy Framework |
| Leadsy | Identifying companies visiting quomerce.com — after consent | EU | Standard contractual clauses |
| OpenAI, L.L.C. (USA) | AI model carrying out the audit: screenshots and content of the audited shop | USA | EU-US Data Privacy Framework, standard contractual clauses |
| Anthropic, PBC (USA) | AI model (Claude) carrying out the audit: screenshots and content of the audited shop | USA | Standard contractual clauses |
| DeepL SE (Germany) | Translating the content of audit reports | EU | — |
Stripe Payments Europe, Limited (Ireland) handles payments for audits bought on quomerce.com as a separate controller — it is not our subprocessor and applies its own privacy policy.
3. Change history
| Date | Change |
|---|---|
| 1.11.2026 | First publication of the list. |