Sub-processors
Effective date: 2026-07-20
YAStuning OÜ engages the third-party sub-processors below to provide the ShopToAI service. Each is bound by a data-processing agreement compliant with Article 28 GDPR. We update this list before adding or replacing a sub-processor, as committed in our DPA.
Current sub-processors
| Sub-processor | Purpose | Data processed | Location / safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting: application servers, database and storage | All service data, including account and billing identifiers, encrypted store credentials, catalog snapshots and logs | Germany (EEA) - data stays in the EEA, no third-country transfer |
| Stripe | Payment processing & subscription management | Account/billing identifiers, Stripe customer & subscription IDs; card data entered directly with Stripe | US / EU - SCCs; EU-U.S. Data Privacy Framework |
| Google (Gemini API / AI Studio) | AI enrichment of catalog text; AI-visibility monitoring queries | Enrichment: product name, SKU, current brand/category, first ~300 chars of description. Monitoring: Brand monitoring: your brand name and the category search queries you configure. Product-level visibility: product name, category (or the product's own brand when it has none, and nothing in that slot when it has neither) and one attribute value, plus the market and language. No prices, SKUs, GTINs, descriptions or images. Your brand name can itself be personal data - a sole trader's business name normally contains the owner's name. | US (Google LLC), paid Gemini API tier - your prompts and responses are not used to train Google's models. SCCs; EU-U.S. Data Privacy Framework where it covers the service used |
| OpenAI | AI-visibility monitoring add-on only | Brand monitoring: your brand name and the category search queries you configure. Product-level visibility: product name, category (or the product's own brand when it has none, and nothing in that slot when it has neither) and one attribute value, plus the market and language. No prices, SKUs, GTINs, descriptions or images. Your brand name can itself be personal data - a sole trader's business name normally contains the owner's name. | US; OpenAI Ireland Ltd is the contracting party for the EEA - Standard Contractual Clauses (Modules 2 and 3). No training on your data. Abuse-monitoring logs kept up to 30 days |
| Perplexity AI | AI-visibility monitoring add-on only | Brand monitoring: your brand name and the category search queries you configure. Product-level visibility: product name, category (or the product's own brand when it has none, and nothing in that slot when it has neither) and one attribute value, plus the market and language. No prices, SKUs, GTINs, descriptions or images. Your brand name can itself be personal data - a sole trader's business name normally contains the owner's name. | US - SCCs (Modules 2 and 3) plus the UK Addendum. No training on your data. Requests and answers are retained for the duration of the Services plus 30 days, with no per-record deletion for API data. Perplexity may use its own model providers as onward sub-processors |
| Cloudflare - Turnstile | Bot/abuse protection on auth forms | Challenge token, IP address | Global edge - SCCs |
| Brevo (Sendinblue SAS) | Transactional email | Recipient email address, message content (e.g. audit summary) | France, EU - SCCs where applicable |
| Google Analytics (Google Ireland / Google LLC) | Website usage analytics - only with your cookie consent | Pseudonymous usage events, cookie identifiers; IP address is not stored by GA4 | US (Google LLC) - EU-U.S. Data Privacy Framework; SCCs |
NOTEOpenAI and Perplexity AI are engaged only for the optional AI-visibility monitoring add-on, and only after you explicitly enable it and instruct us to send the data listed above. If you do not use that add-on, no data is sent to them. You can withdraw that instruction at any time - but data already sent stays subject to each provider's retention above, which we cannot shorten on request.
NOTEGoogle Analytics loads only if you accept analytics cookies on our consent banner (see the Cookie Policy). If you reject, no data is sent to it. We do not use advertising/marketing trackers or any third-party analytics/telemetry provider (no Segment, no hosted Sentry, etc.). For reliability we run self-hosted error tracking on our own infrastructure in the EEA; it diagnoses faults, stays in-house, and is not shared with any outside provider.
International transfers
Where a sub-processor processes data outside the EEA, the transfer relies on appropriate safeguards under Chapter V GDPR - primarily the European Commission's Standard Contractual Clauses, supplemented by the EU-U.S. Data Privacy Framework where the recipient is certified. Copies are available on request at [email protected].
Notification of changes
We notify customers of changes to this list at least 30 days before a new sub-processor begins processing, giving you the opportunity to object on reasonable data-protection grounds (see DPA, Section 6).