Subprocessors & Service Providers
The third parties that process personal information on Merch365's behalf, and how we contractually limit what they can do with it.
Scope: A public list of the third parties that process personal information on Merch365’s behalf, referenced by the Privacy Notice and the Storefront Privacy Notice.
Last updated: June 8, 2026
How we engage service providers
Each provider below processes personal information only to provide services to Merch365, under contracts that (a) limit processing to the specified purposes, (b) require at least the same level of privacy protection that applies to Merch365, (c) require the provider to notify us if it can no longer meet its obligations, and (d) allow us to take steps to stop and remediate unauthorized use.
Current subprocessors
| Provider | Service | Data involved | Surface |
|---|---|---|---|
| Stripe, Inc. | Payment processing, fraud prevention, tax calculation (Stripe Tax) | Payment, billing, transaction metadata | Platform + Storefront |
| Vercel, Inc. | Storefront hosting / edge | Usage, device/log data | Storefront |
| Google Cloud (GCP) | Control-plane hosting and storage | Account, content, logs | Platform |
| Medusa Cloud | Commerce backend / order data | Order, cart, customer data | Storefront |
| PostHog | First-party product analytics | Usage/device data, identifiers | Platform + Storefront |
| Email service provider | Transactional and marketing/outreach email | Contact data, email content | Platform + Storefront |
| Branding / fulfillment partner & decorator network | Production, decoration, and shipping of merchandise | Order contents, personalization files, shipping details | Storefront |
| Shipping carriers (e.g., USPS, UPS, FedEx) | Shipping/delivery | Shipping name/address | Storefront |
Changes
We may add, remove, or replace subprocessors as the service evolves; we will update this page accordingly. We do not currently offer advance-notice rights for new subprocessors; if we add enterprise tenants who require them, we will describe the notice mechanism here.
Contact
Questions about subprocessors: privacy@merch365.ai.