Sub-processors

1. About this page

This page is the single, up-to-date source of the list of sub-processors used by MagicDots. It complements the Data Processing Agreement (DPA) section of the Privacy Policy and the obligations in the Terms of Service.

Merchants generally authorize the use of the sub-processors listed below to provide the Service. We will notify merchants at least 30 days before adding or replacing a sub-processor. The merchant may object on reasoned grounds within that period; if the objection cannot reasonably be resolved, the merchant may terminate the affected part of the service.

Each sub-processor is bound by contractual data-protection obligations at least equivalent to those MagicDots undertakes towards merchants.

2. Sub-processor list

Supabase — database and authentication. Data is hosted in the European Union (Frankfurt region). Normally does not involve any transfer outside the European Economic Area (EEA).

Vercel — hosting and delivery of the web application. US-based provider; where processing takes place outside the EEA, the transfer relies on the Standard Contractual Clauses (SCC) and, where applicable, certification under the EU–US Data Privacy Framework.

Resend — email delivery. US-based provider; transfers outside the EEA rely on the Standard Contractual Clauses (SCC).

Stripe — payment and subscription processing (merchant-account data, not shopper data). Global provider; transfers outside the EEA rely on the Standard Contractual Clauses (SCC) and/or the EU–US Data Privacy Framework.

OpenAI — AI processing of text (content generation and analysis). US-based provider; transfers rely on the Standard Contractual Clauses (SCC). Receives only merchant-authored text, product-catalog information and aggregate statistics — it does not receive shoppers' personal data.

Anthropic — AI processing of text (content generation and analysis). US-based provider; transfers rely on the Standard Contractual Clauses (SCC). Receives only merchant-authored text, product-catalog information and aggregate statistics — it does not receive shoppers' personal data.

3. International transfers and safeguards

We prioritize hosting and processing within the European Union (the database is in the EU, Frankfurt). For transfers to countries outside the EEA that do not benefit from an adequacy decision, we apply appropriate safeguards under Chapter V of the GDPR, in particular the Standard Contractual Clauses (SCC) and, where applicable, the EU–US Data Privacy Framework and supplementary measures.

A copy of the Standard Contractual Clauses can be requested at contact@magicdots.io.

4. Contact

For questions about sub-processors or to object to a change to the list, you can contact us at contact@magicdots.io.