Sub-processors
Effective date: 2026-10-16
YAStuning OĆ uses the third parties below to process personal data on its behalf in providing the ShopToAI service.
Current sub-processors
| Sub-processor | Purpose | Data processed | Location / safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting | All Service data | Germany (EEA) |
| Cloudflare | Website delivery and protection against attacks and bots, including on forms | IP address and request data | Global - SCCs; EU-U.S. Data Privacy Framework where applicable |
| Stripe | Payment processing and subscription management | Billing and payment data | US / EU - SCCs; EU-U.S. Data Privacy Framework |
| Google (Gemini API) | AI processing of catalog data: suggestions, content drafts and AI-visibility monitoring | Product catalog text such as names, categories, descriptions and attributes; brand name and monitoring queries | US (Google LLC) - SCCs; EU-U.S. Data Privacy Framework where applicable |
| OpenAI | AI-visibility monitoring, only if you enable it | Brand name, monitoring queries, and names, categories and attributes of monitored products | OpenAI Ireland Ltd (EEA), with onward transfers to the US - SCCs |
| Perplexity AI | AI-visibility monitoring, only if you enable it | Brand name, monitoring queries, and names, categories and attributes of monitored products | US - SCCs |
| Brevo (Sendinblue SAS) | Transactional email | Email address and message content | France, EU |
| Google Analytics (Google Ireland / Google LLC) | Website analytics, only with your cookie consent | Usage events and cookie identifiers | US (Google LLC) - EU-U.S. Data Privacy Framework; SCCs |
| PostHog (PostHog Inc.) | Website and product analytics; heatmaps and session recordings only with your cookie consent | Pseudonymous IDs, page views, clicks and usage events; with consent, heatmaps and recordings of pages with form text hidden | EU (Frankfurt, Germany); support access by PostHog Inc. (US) - SCCs |
Data sources you connect
Google Merchant Center and Google Search Console are not our sub-processors. If you connect them, they are a data source you choose; see Section 2.11 of the Privacy Policy.
International transfers
Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework (Chapter V GDPR). Copies of the safeguards are available on request at [email protected].
Changes
Changes to this list are notified as set out in our DPA, Section 6.