Skip to content
Strathly

Legal

Subprocessors

The companies that help us run Strathly and process personal data for it: what each one does, what data it receives and where.

Last updated

On this page

The short version

Your data is stored with Hetzner, in Germany, in the European Union. That is where the app, the database and the files run.
OpenAI's models write Ivy's answers. OpenAI keeps what it receives only in its abuse-monitoring logs, for up to 30 days, and does not train its models on it.
Requests to the app and the chat reach our servers through Cloudflare's network, which also checks that a person, not a bot, starts a chat.
Email and push notifications each go through one specialist provider, listed below.
Every store pays through Shopify, on its Shopify bill. Shopify is your own platform, not our subprocessor.
We tell you 30 days before adding a new subprocessor, and you can object.

1. Subprocessors

These companies process the personal data of your store (your shoppers, your conversations, your team) on our behalf, under a written contract with us, only for the purpose shown, as our data processing agreement requires. Transfers outside the European Economic Area are covered by the safeguard named under the location.

  • Hetzner

    Hetzner Online GmbH, Gunzenhausen, Germany

    Hosting: the servers, the database and the file storage (logos and profile photos) that run the app.

    Data: All service data: accounts, store data, conversations, shopper details.

    Where: European Union, Germany (European Union)

  • OpenAI

    OpenAI Ireland Ltd (our contracting party), with processing by OpenAI, L.L.C. and its affiliates in the United States

    The AI models behind Ivy's replies, conversation summaries, drafted replies and the search index of your catalog and knowledge.

    Data: Conversation messages, the shopper's name and email when given, the page the shopper is on and the browser's language, the store's catalog and knowledge, order details Ivy looks up for a shopper. Not stored for later use: kept only in OpenAI's abuse-monitoring logs, for up to 30 days, and never used to train its models.

    Where: United States (Standard Contractual Clauses)

  • Resend

    Plus Five Five, Inc., San Francisco, United States

    Transactional email: account emails, team invites, handoff alerts, replies to shoppers who left the chat, verification codes and the setup link asked for in the iOS app's demo.

    Data: Email addresses, names, the text of the email.

    Where: United States (Standard Contractual Clauses)

  • Apple

    Apple Inc., Cupertino, United States

    Push notifications to the Strathly iOS app (Apple Push Notification service).

    Data: The device's push token, the notification's title and text (a shopper's name and a preview of the conversation, or the text of a teammate's note that @mentions you).

    Where: United States (EU-U.S. Data Privacy Framework, Standard Contractual Clauses)

  • Cloudflare

    Cloudflare, Inc., San Francisco, United States

    Delivering the app (app.strathly.com) through its network, a proxy that also shields it from attacks: the requests of the dashboard, the Strathly iOS app and the chat reach our servers in Germany through it. And bot protection on the chat (Turnstile): when a conversation starts, an invisible check that a person, not a bot, is writing.

    Data: Every request to the app, in transit, to pass it on to our servers: the IP address, browser details and what the request carries (messages, store data, account details). For the bot check: the shopper's IP address and technical signals from their browser and device, with no name, email or message. Cloudflare says it does not use this data to target ads.

    Where: United States, global network (EU-U.S. Data Privacy Framework, Standard Contractual Clauses)

2. Independent companies

These companies receive personal data because of what you ask the service to do, but they decide for themselves how they use it, under their own terms and privacy policies. They are independent controllers, not our subprocessors:

  • Shopify is your store's platform. We read from it and write to it with the permissions you approve, and Shopify bills every store for Strathly: your plan and any extra conversations are on your Shopify bill. Your agreement with Shopify governs what Shopify does with your data.
  • Google Maps Platform suggests addresses while a shopper types one in the chat's address form. Our server sends it only the partial address, the country and the language, under Google's terms for Maps.
  • Shopify

    Your store's platform: where we read the catalog and orders, receive each new or cancelled order to count sales from conversations, change orders when you allow it, check that a shopper is signed in, and bill every store for Strathly (the plan and extra conversations, on your Shopify bill).

    Data: Store, product, order and customer data your store already holds in Shopify; plan, extra conversations and usage for Shopify billing.

    Where: Canada, Ireland (EU adequacy decision for Canada)

  • Google (Maps Platform)

    Address suggestions in the chat's address form (Places API), requested by our server, only while a shopper types an address.

    Data: The partial address a shopper types, the country and the language. No name, email or order.

    Where: United States (EU-U.S. Data Privacy Framework, Standard Contractual Clauses)

3. Providers for our own operations

These providers run our domains, deliver this website and handle our email. They receive the requests of this website's visitors and the emails you send us, not the data of your store, unless you put it in an email. Cloudflare also delivers the app, which carries your store's data, so for that it is listed among the subprocessors above.

  • Cloudflare

    Cloudflare, Inc., San Francisco, United States

    DNS for Strathly's domains, delivering this website (strathly.com) through its network (CDN and proxy, which also shields the site from attacks), and the routing of email sent to our addresses (for example support@strathly.com).

    Data: For visitors of strathly.com: the IP address, browser details and the page asked for. For the emails you send us: your address and the message.

    Where: United States, global network (EU-U.S. Data Privacy Framework, Standard Contractual Clauses)

  • Google (email)

    The mailbox where the emails you send us arrive and where we answer them.

    Data: The emails you send us and our replies: your address and the messages.

    Where: United States, global (EU-U.S. Data Privacy Framework, Standard Contractual Clauses)

4. Services browsers contact directly

These are not our subprocessors, because we send them nothing; a visitor's browser contacts them itself:

  • Shopify runs the store itself: the chat updates the shopper's cart there and checks, through Shopify, whether the shopper is signed in to the store. Shopify's plan page, where you choose and approve your plan, is in your Shopify admin.

5. How we choose them

We use as few providers as we can, and pick each one for the job it does best. Before a subprocessor receives personal data, we check its security and privacy commitments, sign a data processing agreement with it, and make sure any transfer outside the EEA is covered by an adequacy decision or the European Commission's Standard Contractual Clauses. Each one gets only the data its job needs.

6. Changes and notices

When we plan to add or replace a subprocessor, we update this page and email account owners and subscribers at least 30 days before it starts processing personal data. You can object, as our data processing agreement describes.

Subscribe to changes

Email us from the address that should receive the notices and we add it to the list. Account owners are always notified.

Subscribe

7. History

  • : Paddle removed from the independent companies: every store now pays through Shopify, which bills the plan and any extra conversations on the merchant's Shopify bill, so Shopify's row now covers billing for every store. No subprocessor changed.
  • : Cloudflare's row updated: since October 13, 2026 Cloudflare also delivers the app (app.strathly.com) through its network, as a proxy in front of our servers in Germany. The requests of the dashboard, the iOS app and the chat pass through it, so it processes their IP addresses, browser details and content (messages, store data, account details) in transit, to pass them on to us. Its earlier row covered only Turnstile, the chat's bot check, which is unchanged. Same company, same location and safeguards (EU-U.S. Data Privacy Framework, Standard Contractual Clauses).
  • : The legal entity of each company added, and OpenAI's row now names everything Ivy sends it (the shopper's name and email when given, the page and the browser's language) and that OpenAI keeps it only in its abuse-monitoring logs, for up to 30 days. Unsplash removed: this website's images are now served from strathly.com itself, so a visitor's browser loads nothing from third parties. Cloudflare, already our provider for DNS and email routing, now also delivers this website (strathly.com) through its network, as a content delivery network and proxy: it processes visitors' IP addresses and request details to deliver the pages. Your store's data does not pass through it.
  • : Cloudflare added as a subprocessor for Turnstile, the invisible bot check that runs in the chat when a conversation starts: it receives the shopper's IP address and technical signals from the browser and device.
  • : Stripe removed: payments for stores that sign up on our website now go through Paddle, our reseller and Merchant of Record, listed with Shopify and Google Maps Platform as independent companies. Cloudflare and our email mailbox are listed apart, as providers for our own operations. Google Fonts removed: the chat's fonts are now served from our own servers.
  • : First published list.