Sub-processors
Annex III of the Data Processing Addendum, version 1.0, effective October 10, 2026. We give merchants at least 30 days' notice by email before adding or replacing a sub-processor (DPA section 8.4).
Current list and change notices: https://honesttag.com/subprocessors.
| Sub-processor (address; data-protection contact) | What it does for the Service | Shopper Data it receives | Location / transfer basis |
|---|---|---|---|
| Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA; Data Protection Officer, dpo@cloudflare.com) | Runs the entire Service: compute (Workers), storage (KV, D1, R2, Durable Objects, Queues, Analytics Engine) and network | All Shopper Data in Annex I | Global network, United States; EU-U.S. Data Privacy Framework (including its UK Extension and the Swiss-U.S. framework) and SCCs per Cloudflare's data processing terms |
| Plus Five Five, Inc., trading as Resend (2261 Market Street #5039, San Francisco, CA 94114, USA; privacy@resend.com) | Sends HonestTag's email to Merchant, including the data-request notice | Shopify customer ID and order IDs named in a data-request notice | United States; SCCs and the EU-U.S. Data Privacy Framework (including its UK Extension), per Resend's data processing addendum |
| Google LLC (Google Workspace) (address: the notices address in Google's Workspace agreement; Google Workspace data protection team, https://support.google.com/a/contact/googlecloud_dpr) | Hosts HonestTag's support mailbox, from which data-request reports are sent to Merchant | Data-request reports (Section 10) and anything Merchant includes in support correspondence | United States; under Google's Cloud Data Processing Addendum, which Google incorporates into its Google Workspace agreement (https://cloud.google.com/terms/data-processing-addendum) |
| Discord Inc. (444 De Haro Street #200, San Francisco, CA 94107, USA; privacy@discord.com; Data Protection Officer, dpo@discord.com) | HonestTag's internal notification channel: operations alerts about merchant stores, and notices of the support requests HonestTag receives by email or through its website support form | None intentionally. An operations alert names the store and the problem, with Shopper identifiers masked as described below. A support notice states who wrote, their store and what they asked, so it carries any Shopper Data Merchant includes in a support request | United States: Discord states that it processes and stores information on servers located in the United States and that it is the data controller of its users' personal information (Discord Netherlands BV for users in the EEA) (Discord Privacy Policy, effective September 29, 2025). No data processing agreement with Discord covers these messages |
HonestTag offers no merchant support chat on Discord; Discord is used only as the internal notification channel described above. An operations alert names the store (its HonestTag tenant ID and shop domain) and the problem. Before sending it, HonestTag replaces Shopify order and customer IDs, visitor IDs, email addresses, every order name in Shopify's default format (#1001), any word after the word "order" that contains a digit, and every other word that contains a digit, which covers a store's own order-name format (Shopify's examples: EN1001, 1001-A). Kept are dates and times, HTTP status codes, durations, a bare number of one or two digits, and HonestTag's own support codes, record IDs and hashes. An order name left in an alert is therefore possible only where a store's order names are a bare one- or two-digit number, or a number followed only by a time unit, and the alert does not call it an order. Shopify is not a Sub-processor: it is the platform on which Merchant runs its store and from which the Service receives order data, under Merchant's own agreement with Shopify. Ad Platform Recipients are not Sub-processors (Section 8.6).