Subprocessadores

We use a small number of third-party services to operate the MarginLock platform. The table below lists every subprocessor that may process customer personal data on our behalf, along with the purpose, the categories of data, and the region where data is processed.

Vendor	Purpose	Data processed	Region	DPA
Amazon Web Services	Application database, worker compute, object storage, marketing site hosting, transactional email (magic links, contact form, account notifications, sent via SES)	Customer Amazon Seller Central data, account metadata, warehouse measurement photos (not active in the current release: the warehouse measurement feature is disabled, so no new photos are captured or sent; anything already held is covered by the deletion terms in our DPA), email addresses, message bodies, IP addresses, request metadata	us-east-1 (USA)	AWS DPA
Anthropic	Vision analysis of warehouse measurement photos (scale readings, box dimensions) — not active in the current release: the warehouse measurement feature is disabled, so no new photos are sent	Photos captured by warehouse users during shipment measurement	USA	Anthropic DPA
PostHog	Product analytics, session replay, feature flags, error tracking	Email addresses, IP addresses, device and usage metadata, user identifiers, session recordings	EU (PostHog Cloud EU)	PostHog DPA
iubenda	Cookie consent banner and consent management (CMP)	IP addresses, browser and referrer metadata, cookie consent preferences	EU (Italy)	iubenda DPA
Better Stack	Uptime + status page	Probe results	USA, EU regions	Better Stack DPA
Stripe	Subscription billing	Email addresses, billing addresses, payment metadata (no card numbers)	USA, EU regions	Stripe DPA

We notify customers in writing at least 30 days before adding or replacing a subprocessor. Customers may object to a new subprocessor under the terms of our DPA.