Sub-processors
Effective date: 2026-07-20
YAStuning OÜ engages the third-party sub-processors below to provide the ShopToAI service. Each is bound by a data-processing agreement compliant with Article 28 GDPR. We update this list before adding or replacing a sub-processor, as committed in our DPA.
Current sub-processors
| Sub-processor | Purpose | Data processed | Location / safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting: application servers, database and storage | All service data, including account and billing identifiers, encrypted store credentials, catalog snapshots and logs | Germany (EEA) - data stays in the EEA, no third-country transfer |
| Stripe | Payment processing & subscription management | Account/billing identifiers, Stripe customer & subscription IDs; card data entered directly with Stripe | US / EU - SCCs; EU-U.S. Data Privacy Framework |
| Google (Gemini API / AI Studio) | AI enrichment of catalog text; AI-visibility monitoring queries | Product name, SKU, current brand/category, first ~300 chars of description. For monitoring: your brand name and category search queries. No account-holder personal data, pricing or images. | US (Google LLC), paid Gemini API tier - your prompts and responses are not used to train Google's models. SCCs; EU-U.S. Data Privacy Framework where it covers the service used |
| OpenAI | AI-visibility monitoring add-on only | Your brand name and category search queries you configure. No account-holder personal data, catalog records, pricing or images. | US (OpenAI) - Standard Contractual Clauses |
| Perplexity AI | AI-visibility monitoring add-on only | Your brand name and category search queries you configure. No account-holder personal data, catalog records, pricing or images. | US - SCCs |
| Cloudflare - Turnstile | Bot/abuse protection on auth forms | Challenge token, IP address | Global edge - SCCs |
| Brevo (Sendinblue SAS) | Transactional email | Recipient email address, message content (e.g. audit summary) | France, EU - SCCs where applicable |
| Google Analytics (Google Ireland / Google LLC) | Website usage analytics - only with your cookie consent | Pseudonymous usage events, cookie identifiers; IP address is not stored by GA4 | US (Google LLC) - EU-U.S. Data Privacy Framework; SCCs |
NOTEOpenAI and Perplexity AI are engaged only for the optional AI-visibility monitoring add-on, and only after you explicitly enable it and consent to sending your brand and query data to these providers. If you do not use that add-on, no data is sent to them. You can withdraw consent at any time.
NOTEGoogle Analytics loads only if you accept analytics cookies on our consent banner (see the Cookie Policy). If you reject, no data is sent to it. We do not use advertising/marketing trackers or any third-party analytics/telemetry provider (no Segment, no hosted Sentry, etc.). For reliability we run self-hosted error tracking on our own infrastructure in the EEA; it diagnoses faults, stays in-house, and is not shared with any outside provider.
International transfers
Where a sub-processor processes data outside the EEA, the transfer relies on appropriate safeguards under Chapter V GDPR - primarily the European Commission's Standard Contractual Clauses, supplemented by the EU-U.S. Data Privacy Framework where the recipient is certified. Copies are available on request at [email protected].
Notification of changes
We notify customers of changes to this list at least 30 days before a new sub-processor begins processing, giving you the opportunity to object on reasonable data-protection grounds (see DPA, Section 6).