Effective 19 October 2026
Sub-processors
Every third party involved in running the service, what they are for, and what they can see. This list is public so you never have to ask for it.
The current list
| Sub-processor | What it does | Where | What it touches |
|---|---|---|---|
| Hostinger International | Application hosting — our server, which runs the application and job queue and holds file uploads, server logs and encrypted backups | Mumbai, India | All platform data in processing; at rest, the job queue, file uploads, server logs and encrypted backups |
| Supabase, Inc. | Managed database hosting (production database) | Mumbai, India (AWS ap-south-1 region); the database's own logs are stored in the EU | All service data held in the database: merchant account data, and the data of merchants' customers and members that the service processes. Encrypted at rest by Supabase; our connections to it are TLS-encrypted with the certificate verified. Our application reaches it only through our own database roles; Supabase, as the provider, can also administer the platform it runs on. Separately, Supabase takes a daily backup of the database and keeps each one for 7 days, the retention Supabase states for our plan; there is no continuous, minute-by-minute backup. The database's own logs, which may contain personal data from the database, are stored by Supabase in data centres in the EU. |
| Resend | Transactional email delivery — sign-in codes, member notifications, merchant and operational emails | Japan (AWS Tokyo region); Resend, Inc. is based in the United States | Recipient email address and message content |
| Cloudflare (R2) | Encrypted off-site backup storage | Global — Cloudflare stores objects in its data centres worldwide; Cloudflare, Inc. is based in the United States | Hourly and nightly database backups, encrypted on our server before upload; Cloudflare cannot read them |
| Cloudflare (Email Routing) | Receives email sent to @stickytier.com addresses and forwards it to our mailbox | Global network; Cloudflare, Inc. is based in the United States | Emails people send us — sender address and anything in the message |
| Google (Gmail) | Our mailbox: the emails people send to @stickytier.com addresses, and our operational alert emails | United States and other countries where Google operates | Those emails — sender address and anything in the message; alerts can name a merchant, a staff member or an affected record |
| Shopify | Source commerce platform for connected stores | Per the merchant's own Shopify agreement | Orders, customers and refunds the merchant authorises us to read; the discount codes and store credit we issue back |
| GitHub | Source code hosting and deployment automation | United States | None — no customer or member data is stored in or passes through it |
What this list does not include
There is no analytics, advertising, session-recording or customer-messaging product embedded anywhere in StickyTier — not on the marketing site, not in the admin, not in the member portal. That is why you will not find one here. Nothing about your members is sent to a third party for that party's own purposes.
Where your data physically sits
The application and database run in Mumbai, India. Backups are encrypted on our server before upload, so the storage provider holds ciphertext it cannot read. Our backups are encrypted with age on our server before they are written or uploaded. The private key is kept only on the operator's own device, in a password manager that is not synced to any cloud service, with a second copy kept offline; it is never on our servers. Each backup is deleted when its 35-day period ends. The database previously hosted on our own server was copied to Supabase on 19 October 2026, kept read-only as a rollback copy, and was deleted on 22 October 2026.
Personal data leaves India routinely in four ways:
- Transactional email — the recipient's address and the message — is sent through Resend: Japan (AWS Tokyo region); Resend, Inc. is based in the United States.
- Encrypted database backups are stored in Cloudflare R2, which is global storage. They are encrypted on our server before upload, so Cloudflare holds data it cannot read.
- Email people send to our @stickytier.com addresses passes through Cloudflare Email Routing (global) to our mailbox with Google (Gmail) (United States and other countries where Google operates), which also receives our operational alerts.
- The database's own logs, which may contain personal data from the database, are stored by Supabase, our database host, in data centres in the EU.
Changes, and objecting to one
We will tell merchants at least 30 days before adding or replacing a sub-processor — by email to each account's owner and a notice in StickyTier — so there is time to raise a concern. If a change is unacceptable to you, tell us and we will work through it; if we cannot, you may terminate without penalty and export everything first — see section 4 of the Data Processing Agreement.
Some optional parts of our own operations would add a provider to this list if we switched them on — for example mirroring uploaded files to a second storage provider, or sending operational alerts through a push-notification service. None is in use today; turning one on follows the same 30-day notice.
To be notified of changes, or to object to one, write to privacy@stickytier.com. How we handle the data itself is on the privacy page.