// trust center · sub-processors

Sub-processors

Every provider that processes data for Magistry: what it does, the categories of data it receives, and where. 60 providers, 35 of which receive personal data. Last updated 2026-10-20.

Back to the Trust Center

Read the DPA

// the list

Who processes data, and what they receive.

This is the list the DPA's Annex C renders. Most providers below the core infrastructure only receive data when you connect them. Under the DPA we give thirty days' notice before adding or replacing a sub-processor. Link one provider with its anchor, for example #anthropic.

Shopify
Commerce platform, billing, and payments. Card data is handled by Shopify and never reaches Magistry.
Data categories:
- Merchant account and billing identity (personal data)
- Store, catalogue and order data
- Shopper contact details (personal data)
Region: Global
Supabase
Primary Postgres database, auth, storage, and Vault-encrypted secrets.
Data categories:
- Everything Magistry stores or processes (personal data)
Region: EU (eu-west-1)
Vercel
Hosting for the dashboard and marketing website, with edge delivery.
Data categories:
- Everything Magistry stores or processes (personal data)
Region: Global edge network
Railway
Compute for the backend worker and scheduled jobs.
Data categories:
- Everything Magistry stores or processes (personal data)
Region: EU (Amsterdam, europe-west4)
Anthropic
LLM inference for the agents and the assistant, including customer-service reply drafting over inbound mail bodies and customer photographs. No training on customer data.
Data categories:
- Message content (personal data)
- Customer photographs (personal data)
- Store, catalogue and order data
Region: United States
OpenAI
Embeddings, classification, translation of customer-service text, and image generation. No training on customer data. Separately, OpenAI Ads — when you connect it: campaign, ad-group and ad metadata and performance reports, under your own ads API key; and, only when you choose conversion tracking for it, each paid order (order id, value, currency, hashed email and phone, the OpenAI click id) sent to OpenAI's Conversions API, and OpenAI's measurement pixel loaded on your storefront after the visitor's marketing consent.
Data categories:
- Message content (personal data)
- Product imagery and prompts
- Campaign data and aggregate metrics
- Conversion events (hashed identifiers, click ids) (personal data)
Region: United States
fal
Generative media for the creative studio: product video, image edits and instrumental music (ElevenLabs Music, run on fal). Receives the prompt and the product imagery a merchant chooses; no shopper or customer data is sent.
Data categories:
- Product imagery and prompts
Region: United States
Resend
Transactional and customer-service email delivery.
Data categories:
- Message content (personal data)
- Shopper contact details (personal data)
Region: EU/US
Smartlead
Mailbox warm-up for Magistry's own outbound prospecting mailboxes: the sending address, its display name and its SMTP/IMAP credential are registered with the provider, which then warms the mailbox by exchanging mail with its own network. Magistry's own senders, not a tenant's data. The cold-sending path through this provider is present in code and disarmed.
Data categories:
- Magistry's own mailbox identity (personal data)
Region: Unverified — vendor confirmation pending
Microsoft
Outlook / Microsoft 365 mailbox access and sending for connected customer-service inboxes (Graph API); Bing Ads and Bing Webmaster where connected.
Data categories:
- Message content (personal data)
- Shopper contact details (personal data)
- Campaign data and aggregate metrics
Region: EU/US
Google
Gmail mailbox access for connected inboxes; Google Ads, Data Manager (hashed e-mail/phone and click ids on conversion upload), Analytics, Merchant Center, Search Console and Sheets when you connect them; Google Public DNS for domain checks; the Gemini API, which analyses the video and audio of creatives for the creative engine.
Data categories:
- Message content (personal data)
- Shopper contact details (personal data)
- Conversion events (hashed identifiers, click ids) (personal data)
- Campaign data and aggregate metrics
- Store, catalogue and order data
- Product imagery and prompts
- Domain names
Region: EU/US
Meta
Meta Ads, Meta Pixel and Conversions API (hashed identifiers) — when you connect them.
Data categories:
- Conversion events (hashed identifiers, click ids) (personal data)
- Campaign data and aggregate metrics
Region: United States
TikTok
TikTok for Business ads and events (hashed identifiers) — when you connect them.
Data categories:
- Conversion events (hashed identifiers, click ids) (personal data)
- Campaign data and aggregate metrics
Region: EU/US
Pinterest
Pinterest Ads and conversions — when you connect them; with conversion tracking chosen for it, the Pinterest Tag on your storefront after the visitor's marketing consent.
Data categories:
- Conversion events (hashed identifiers, click ids) (personal data)
- Campaign data and aggregate metrics
Region: United States
Reddit
Reddit Ads and conversions — when you connect them. The OAuth grant and token refresh go to reddit.com; campaign reads, writes and server-side conversions go to the Ads API. When you let Magistry run Reddit tracking, the storefront loads the Reddit Pixel from redditstatic.com after marketing consent.
Data categories:
- Conversion events (hashed identifiers, click ids) (personal data)
- Campaign data and aggregate metrics
Region: United States
Amazon Ads
Amazon Advertising — when you connect it. Login with Amazon refreshes the token; campaign and ad-group reads and writes, and performance reports, go to the Advertising API. Campaign metadata and aggregate metrics only: no customer identifiers are uploaded.
Data categories:
- Campaign data and aggregate metrics
Region: EU/US
bol
bol Retailer API — when you connect a bol seller account. Offer, order, return and performance-indicator reads under the seller's own API credentials. An order read carries the buyer's name, delivery and billing address and e-mail as bol returns them.
Data categories:
- Store, catalogue and order data
- Shopper contact details (personal data)
Region: EU (Netherlands/Belgium)
Kaufland
Kaufland Marketplace Seller API — when you connect a Kaufland seller account. Offer, order, return and ticket reads under the seller's own API keys. An order read carries the buyer's name, delivery and billing address and e-mail as Kaufland returns them.
Data categories:
- Store, catalogue and order data
- Shopper contact details (personal data)
Region: EU (Germany)
Allegro
Allegro REST API — when you connect an Allegro seller account. Offer, order, return and seller-rating reads under the authorization the seller grants Magistry. An order read carries the buyer's name, delivery and billing address and e-mail as Allegro returns them.
Data categories:
- Store, catalogue and order data
- Shopper contact details (personal data)
Region: EU (Poland)
Lightspeed
Lightspeed eCom API — when you connect your own Lightspeed shop. Catalogue, order and customer reads under your own read-only API key and secret. An order or customer read carries the shopper's name, address and e-mail as Lightspeed returns them; Magistry stores only the catalogue.
Data categories:
- Store, catalogue and order data
- Shopper contact details (personal data)
Region: EU (Netherlands) or US, per your shop's cluster
TikTok Shop
TikTok Shop Partner API — when you connect a TikTok Shop seller account. Shop, product, SKU, price, stock and order reads under the authorization the seller grants Magistry. An order read carries the buyer's delivery address as TikTok Shop returns it; Magistry does not store it.
Data categories:
- Store, catalogue and order data
- Shopper contact details (personal data)
Region: EU/UK/US
Sendcloud
Sendcloud shipping API — when you connect a Sendcloud account. Parcel reads under your own API key pair: carrier, tracking number, delivery status, destination country, weight and order value per parcel. A parcel read carries the recipient's name and address as Sendcloud returns them; Magistry does not store them.
Data categories:
- Store, catalogue and order data
- Shopper contact details (personal data)
Region: EU (Netherlands)
Exact Online
Exact Online API — when you connect an Exact Online administration. For commerce: item, cost-price and stock reads. For a business's books, when it connects them for a switch to Magistry: its general ledger accounts, relations (customers and suppliers), journals, transaction lines and open items are read. Read only, under the authorization you grant Magistry.
Data categories:
- Store, catalogue and order data
- Financial records (personal data)
Region: EU (Netherlands); the regional host of your administration
Moneybird
Moneybird API — only when a business connects the books it keeps in Moneybird, for a switch to Magistry. Its ledger accounts, contacts, journal documents and open invoices are read under the authorization the business grants; nothing is written.
Data categories:
- Financial records (personal data)
Region: EU (Netherlands)
e-Boekhouden
e-Boekhouden API — only when a business connects the books it keeps in e-Boekhouden with its own API token, for a switch to Magistry. Its ledgers, relations, mutations and open items are read; nothing is written.
Data categories:
- Financial records (personal data)
Region: EU (Netherlands)
Enable Banking
Open-banking account access — only when a business or person connects a bank account in Magistry's books. Account list, balances and transactions are read under the consent the account holder gives at their own bank (at most 180 days); nothing is paid or initiated.
Data categories:
- Financial records (personal data)
Region: EU (Finland); your bank's own region
Recommand
Peppol access point — only when a business registers for e-invoicing in Magistry's books. The business's name, KvK number and address are registered on the Peppol network; when the business chooses to receive invoices over Peppol, Recommand receives them on its behalf.
Data categories:
- Merchant account and billing identity (personal data)
- Financial records (personal data)
Region: EU (Belgium)
Mollie
Payment-provider payout statements — only when a business connects its Mollie account in Magistry's books. Settlements and the payments, refunds and chargebacks in them are read to book each payout; nothing is paid or initiated.
Data categories:
- Financial records (personal data)
Region: EU (Netherlands)
Klarna
Payment-provider payout statements — only when a business connects its Klarna merchant account in Magistry's books. Payouts and their transactions are read to book each payout; nothing is paid or initiated.
Data categories:
- Financial records (personal data)
Region: EU (Sweden)
Amazon Selling Partner API
Marketplace settlement reports — only when a business connects its Amazon seller account in Magistry's books. Login with Amazon refreshes the token; settlement reports are read to book each payout; nothing is listed, sold or paid.
Data categories:
- Financial records (personal data)
Region: EU/US
Taboola
Taboola Backstage — when you connect it. Campaign reads and writes and performance reports, authenticated by the Backstage credentials your account manager issues. Campaign metadata and aggregate metrics only: no customer identifiers are uploaded.
Data categories:
- Campaign data and aggregate metrics
Region: United States/Israel
Criteo
Criteo Marketing Solutions — when you connect it. Campaign and ad-set reads and writes and performance reports, under the API client id and secret from your Criteo account. Campaign metadata and aggregate metrics only: no customer identifiers are uploaded by us — Criteo's own audiences come from its tag on your storefront, which is your relationship with Criteo, not ours.
Data categories:
- Campaign data and aggregate metrics
Region: EU (France)
Outbrain
Outbrain Amplify — when you connect it. Campaign, budget and promoted-link reads and writes and performance reports, authenticated by the Amplify API login you enter. Campaign metadata and aggregate metrics only: no customer identifiers are uploaded.
Data categories:
- Campaign data and aggregate metrics
Region: United States/Israel
Snap
Snap Marketing API (Snapchat Ads) — when you connect it. Campaign, ad squad and ad reads and writes and performance reports, under the OAuth grant you give Magistry in Snapchat. Campaign metadata and aggregate metrics only: no customer identifiers are uploaded.
Data categories:
- Campaign data and aggregate metrics
Region: United States
X
X Ads API — when you connect it. Campaign and line-item reads and writes and performance reports, under the OAuth grant you give Magistry on X. Campaign metadata and aggregate metrics only: no customer identifiers are uploaded.
Data categories:
- Campaign data and aggregate metrics
Region: United States
StackAdapt
StackAdapt — when you connect it. Campaign reads and delivery reports, authenticated by the StackAdapt API key you enter. Nothing is written to the StackAdapt account. Campaign metadata and aggregate metrics only: no customer identifiers are uploaded.
Data categories:
- Campaign data and aggregate metrics
Region: Canada
AppLovin (AXON)
AppLovin's AXON advertising — when you connect it. Campaign reads and writes on the management API and performance reports on the reporting host, under your own AppLovin keys. Campaign metadata and aggregate metrics only: no customer identifiers are uploaded.
Data categories:
- Campaign data and aggregate metrics
Region: United States
Stripe
Subscription billing and invoicing for non-Shopify tenants (merchant billing identity; card data handled by Stripe). When a business connects its own restricted Stripe key in Magistry's books: read-only balance and payout reads for its bookkeeping.
Data categories:
- Merchant account and billing identity (personal data)
- Financial records (personal data)
Region: EU/US
GitHub
Version control for storefront themes: each connected store's theme files are kept in a private repository in Magistry's GitHub organisation, to which the merchant is given access.
Data categories:
- Storefront theme files
Region: United States
Sentry
Error monitoring for the dashboard and worker. The integration is in the code but no Sentry project is configured, so no data is sent to Sentry today.
Data categories:
- None (not active)
Region: Not active
DataForSEO
Search and market data for the Researcher and competitor intelligence (keywords, domains — no personal data).
Data categories:
- Search queries and public web pages
Region: United States
SerpApi
Search-result pages for market research (keywords only).
Data categories:
- Search queries and public web pages
Region: United States
Bright Data
Proxy and unblocking for fetching public web pages (storefronts, marketplaces). No personal data of yours is sent.
Data categories:
- Search queries and public web pages
Region: Israel/US
Exa
Neural web search for research (queries only).
Data categories:
- Search queries and public web pages
Region: United States
Jina AI
Readable-text extraction of public web pages (URLs only).
Data categories:
- Search queries and public web pages
Region: EU/US
17TRACK
Parcel tracking status for shipments the desk is asked about (tracking numbers only).
Data categories:
- Tracking numbers
Region: Global
Slack
Notifications to a Slack channel you configure (incoming webhooks).
Data categories:
- Notification text
Region: United States
Cloudflare
DNS-over-HTTPS lookups when verifying domains.
Data categories:
- Domain names
Region: Global
PayPal
Affiliate payouts (payee e-mail and payout amounts) — affiliates only; and, when a business connects its PayPal account in Magistry's books, its transaction history is read to book each month's payouts (nothing is paid or initiated).
Data categories:
- Payee identity (personal data)
- Financial records (personal data)
Region: United States
Wise
Affiliate payouts by bank transfer (payee name, bank details) — affiliates only.
Data categories:
- Payee identity (personal data)
Region: EU/UK
Tax1099
US tax-form filing for affiliates (name, address, tax id) — affiliates only.
Data categories:
- Payee identity (personal data)
Region: United States
ADROIT (Malta)
Certified out-of-court dispute settlement body under DSA Art. 21. Receives a merchant's complaint against a platform decision, including the identification line that names who is filing and on whose behalf.
Data categories:
- Complaint and filer identity (personal data)
Region: EU (Malta)
LinkedIn
Publishing to a LinkedIn page you connect (post content only), and LinkedIn Ads — when you connect it: campaign and creative reads and writes and performance reports, under the OAuth grant you give Magistry in LinkedIn. Campaign metadata and aggregate metrics only: no customer identifiers are uploaded.
Data categories:
- Published post content
- Campaign data and aggregate metrics
Region: United States
DHL
Parcel tracking status for shipments the desk is asked about (tracking numbers only).
Data categories:
- Tracking numbers
Region: EU
GoDaddy
Domain-name availability checks for the Researcher (candidate names only).
Data categories:
- Domain names
Region: United States
IP geolocation (ipinfo.io, ipapi.co)
Country lookup of an IP address: the worker's own proxy egress (ipinfo.io) and the Shield script's visitor check (ipapi.co) — an IP address is personal data.
Data categories:
- IP address (personal data)
Region: United States
Public data feeds
Weather (Open-Meteo), macro data (ECB, St. Louis Fed FRED), exchange rates (ER-API), news (NewsAPI), Hacker News (Algolia), UK Companies House — queries only, no personal data.
Data categories:
- Search queries and public web pages
Region: Global
Pushover
Push notifications of platform health alerts to the operator's own devices (alert text only).
Data categories:
- Notification text
Region: United States
Telegram
Push notifications of platform health alerts to an operator-configured chat (alert text only).
Data categories:
- Notification text
Region: Global
Expo
Push notification delivery to the Magistry mobile app. Receives the device's push token and the notification text — the store name, what is waiting for a decision, its amount and its deadline. It carries no end-customer data: the notification is about a merchant's own operations, and the decision itself is made in the app against our own API. Expo hands the message to Apple (APNs) or Google (FCM), which are the platform transports and are listed separately.
Data categories:
- Device push token (personal data)
- Notification text
Region: United States