Effective 19 September 2026
Sub-processors
Every third party involved in running the service, what they are for, and what they can see. This list is public so you never have to ask for it.
The current list
| Sub-processor | What it does | Where | What it touches |
|---|---|---|---|
| Hostinger International | Application and database hosting | Mumbai, India | All platform data, at rest and in processing |
| Cloudflare | Encrypted off-site backup storage (R2) | Global object storage | Nightly database backups, encrypted before they leave our server |
| Resend | Transactional email delivery | United States | Recipient email address and message content |
| Shopify | Source commerce platform for connected stores | Per the merchant's own Shopify agreement | Orders, customers and refunds the merchant authorises us to read |
| GitHub | Source code hosting and deployment automation | United States | None — no customer or member data is stored in or passes through it |
What this list does not include
There is no analytics, advertising, session-recording or customer-messaging product embedded anywhere in StickyTier — not on the marketing site, not in the admin, not in the member portal. That is why you will not find one here. Nothing about your members is sent to a third party for that party's own purposes.
Where your data physically sits
The application and database run in Mumbai, India. Backups are encrypted on our server before upload, so the storage provider holds ciphertext it cannot read — the private key is kept offline and never leaves our possession.
The only routine flow of personal data outside India is transactional email: a recipient address and the message itself, passing through Resend in the United States so that sign-in codes and programme notifications actually arrive.
Changes, and objecting to one
We will tell merchants before adding or replacing a sub-processor, with enough notice to raise a concern. If a change is unacceptable to you, tell us and we will work through it; if we cannot, you may terminate without penalty and export everything first.
To be notified of changes, or to object to one, write to privacy@stickytier.com. How we handle the data itself is on the privacy page.