Legal
Sub-processors
The third parties Retail Commerce AI engages to process personal data on behalf of merchants. This is the maintained list referred to in clause 6 of the Data Processing Agreement.
Current sub-processors
| Sub-processor | Purpose, data and location |
|---|---|
| Supabase, Inc. | Database, authentication, encrypted secret storage. All categories described in the DPA. Republic of Korea (AWS ap-northeast-2). |
| Vercel Inc. | Application hosting and execution. All categories, in transit. United States, with a global edge network. |
| Amazon Web Services, Inc. | Underlying infrastructure for the services above and for the workflow server. All categories, at rest and in transit. As stated for each service. |
| OpenAI, L.L.C. | Generating assistant replies, and speech-to-text transcription of voice messages. Shopper message text, the business profile supplied by the merchant, and audio content where a voice message is used. United States. |
| Anthropic PBC | The interactive demo on retailcommerceai.com only — not merchant conversations. What a visitor types into that demo. No merchant or shopper data reaches it. United States. |
| Meta Platforms, Inc. | Message delivery on Instagram, Facebook Messenger and WhatsApp. Message content, platform-scoped identifiers. Global. |
| Shopify Inc. | Source of catalogue and order data. Order and customer data. Global. |
| Resend | Sending account and invitation email. Merchant staff email addresses. United States. |
Our own infrastructure
Message ingestion and reply-generation workflows run on a self-hosted workflow server at n8n.husnoada.com, operated by Retail Commerce AI on cloud infrastructure provided by Amazon Web Services, which is listed above. Every shopper message on every channel passes through it.
It is not listed as a sub-processor because it is not a third-party service. Were it to be operated by anyone other than Retail Commerce AI, that operator would become a sub-processor with access to message content, would appear in the table above, and merchants would be notified under clause 6 before the change took effect.
Changes to this list
Under clause 6 of the Data Processing Agreement, merchants receive at least thirty (30) days’ notice by email before a sub-processor is added or replaced, and may object on reasonable data protection grounds within that period. If an objection cannot be resolved, the merchant may terminate the affected part of the service and receive a refund for the unused remainder of the term.
Questions about anything on this page can go to hello@retailcommerceai.com.