Subprocessors
Last updated: October 19, 2026
Aglyn LLC uses the third-party subprocessors below to provide the Services. This list supports the Data Processing Addendum and Privacy Policy. We update this list and the change log below to reflect the subprocessors currently engaged. Section 7 of the DPA governs Aglyn's use of subprocessors. Services a merchant connects with its own account, including shipping, fulfillment, post-purchase, sales tax, accounting, inventory and ERP, online marketplace, print-on-demand, email and SMS marketing, sales channel and product catalog, automation, delivery app, live chat, website translation, review, local courier and help desk services, such as QuickBooks, Amazon, Klaviyo, Tidio, LiveChat, Weglot, Trustpilot, Yotpo, DoorDash Drive, Gorgias, Re:amaze, Kustomer, Gladly or Richpanel, act for that merchant and are not Aglyn subprocessors.
Core infrastructure & platform subprocessors
| Subprocessor | Provider entity | Purpose | Data processed | Location |
|---|---|---|---|---|
| Google Firebase Authentication | Google LLC | User authentication, sign-in, sessions and account emails | Account identifiers, email, auth tokens, OAuth identities | United States (Google operates a global service) |
| Google Cloud Firestore | Google LLC | Primary application database (multi-tenant) | Account, org, content, commerce, CRM, and configuration data | United States (nam5 US multi-region) |
| Google Cloud / Firebase Storage | Google LLC | Media and asset storage | Uploaded images, video, files | United States (US multi-region) |
| Vercel Inc. | Vercel Inc. | Application hosting, edge/CDN, custom-domain SSL and provisioning; and, as Aglyn’s registrar partner, searching, registering, renewing and transferring domain names customers buy through the Services, and hosting their DNS | Request/usage data, IP, content served; the domain names customers search for; and, for a name a customer buys, the registrant’s name, email address, telephone number, postal address and company name, which Vercel passes to the ICANN-accredited registrar that sponsors the name, and through it to the registry for the domain’s ending, to hold as the domain’s registrant contact. No card or bank details | United States (primary compute), with a global edge network for cached content |
| Stripe, Inc. | Stripe, Inc. | Subscription billing and, via Stripe Connect, facilitation of Customer merchant sales | Billing contact, subscription/transaction metadata, payment data (processed by Stripe) | United States |
| Resend | Plus Five Five, Inc. (d/b/a Resend) | Delivery of email sent by the Services | Recipient email, message content/metadata | United States |
| Google reCAPTCHA | Google LLC | Bot protection / anti-abuse (via Firebase App Check) | IP, device/browser signals, interaction data | United States (Google operates a global service) |
| Google Analytics | Google LLC | Analytics for Aglyn’s own websites and console. The analytics property is linked to Aglyn’s Google Ads account with personalized advertising enabled, so analytics data may also be used to build and export advertising audiences. Data is kept for 14 months. Google’s tag on these properties may also load Google Ads and a Google Tag Manager container, whose contents are configured in Google’s interface | IP address, device/browser signals, page and event interaction data, a cookie-based pseudonymous identifier | United States (Google operates a global service) |
| Google Fonts | Google LLC | Serving web fonts to the Aglyn site editor and to the payment form in a site’s checkout. Published sites serve their own fonts and do not request them from Google | IP address and browser user-agent, sent by the browser when it requests a font | United States (Google operates a global service) |
| Google Cloud Logging | Google LLC | Collecting browser error reports from the Services, for diagnosis and reliability | Technical diagnostic information about errors in the Services, such as error details, the page and code where an error occurred, the application version, and general characteristics of the browser and device | United States (Google operates a global service) |
| Google Cloud Vertex AI | Google LLC | AI image generation: creating images for a customer's media library from a description a user writes | The description the user writes and the shape requested, and the generated image returned. No account identifiers, email addresses, or other content of the customer's site. | Global — Google selects where requests are processed |
| Anthropic | Anthropic, PBC | AI features of the Services, including the Aglyn Assist helper: creating, editing and reviewing content, drafts and settings for a customer’s site, store and CRM, and explaining and summarizing the customer’s own setup and data | What the user submits to an AI feature, including earlier messages in the same conversation, the response generated, and the customer content and context the feature works on. Depending on the feature, this can include the organization’s name and the page the user is working in; the site’s pages, structure, settings and theme; store and product details, with a reduced copy of a product photo; a CRM record the user opens, with all of its fields; how an automation is set up and what its runs did; and aggregated figures about the customer’s own business. No passwords, account identifiers or authentication tokens | United States |
| Linear | Linear Orbit, Inc. | Filing and triage of issue reports users submit from the Services | The report text, the reporter’s email address and account identifier, their organization’s name and identifier, and technical details of the session, such as the page, browser and application version | United States |
| Meta Pixel | Meta Platforms, Inc. | Advertising measurement and retargeting on Aglyn’s own websites and console, and on customer sites whose owners set it up. For account holders in the United States, matching a hashed copy of the account email address so Aglyn’s own ads can be shown to, or kept from, people who already have an account | Page views and conversion events, with the identifiers the pixel sets, from visitors whose consent choices permit advertising where consent is asked. On the console these can belong to a signed-in user and identify their organization. For account holders in the United States, a hashed (one-way scrambled) copy of the account email address | United States |
| LinkedIn Insight Tag | LinkedIn Corporation | Advertising measurement and retargeting on Aglyn’s own websites and console, and on customer sites whose owners set it up. For account holders in the United States, matching a hashed copy of the account email address so Aglyn’s own ads can be shown to, or kept from, people who already have an account | Page views and conversion events, with the identifiers the tag sets, from visitors whose consent choices permit advertising where consent is asked. On the console these can belong to a signed-in user and identify their organization. LinkedIn also sets cookies on its own domain. For account holders in the United States, a hashed (one-way scrambled) copy of the account email address | United States |
| Google Ads | Google LLC | Advertising measurement and retargeting on Aglyn’s own websites and console, and on customer sites whose owners set it up. For account holders in the United States, matching a hashed copy of the account email address so Aglyn’s own ads can be shown to, or kept from, people who already have an account | Page views and conversion events, with the identifiers Google’s tags set, from visitors whose consent choices permit advertising where consent is asked. On the console these can belong to a signed-in user and identify their organization. Advertising audiences built from Aglyn’s Google Analytics data are also shared with this account. For account holders in the United States, a hashed (one-way scrambled) copy of the account email address | United States (Google operates a global service) |
| Wistia | Wistia, Inc. | Hosting and playing Aglyn’s own videos on its websites | IP address and browser user-agent, sent by the browser when the player loads, and viewing data such as what was played and for how long. Wistia records a visitor’s viewing session only when their privacy choices permit analytics | United States |
| Apple Push Notification service | Apple Inc. | Delivering push notifications to Aglyn’s apps on Apple devices, including iPhone, iPad and Mac | Notification title and body, and the device push token | United States |
| Firebase Cloud Messaging | Google LLC | Delivering push notifications to Aglyn’s apps on Android devices | Notification title and body, and the device push token | United States (Google operates a global service) |
| Twilio | Twilio Inc. | Delivery of text messages a site sends its own customers, such as order receipts and shipping updates | The recipient’s phone number and the message text, such as the store name, order number, amounts and tracking or order status links | United States |
| Shippo | Popout, Inc. (Shippo) | Shipping for merchants who sell physical goods: carrier rates, shipping labels, address validation and parcel tracking | The workspace’s name and a member’s email address, ship-from and delivery addresses, the recipient’s name, phone number and email address, the parcel’s weight, size, value and, for an international parcel, its contents, tracking numbers, and the details of a carrier account a merchant connects. No card or bank details | United States |
| EasyPost | Simpler Postage, Inc. (EasyPost) | Shipping for merchants who sell physical goods: carrier rates, shipping labels, address validation and parcel tracking | The workspace’s name and a member’s email address, ship-from and delivery addresses, the recipient’s name, phone number and email address, the parcel’s weight, size, value and, for an international parcel, its contents, tracking numbers, and the details of a carrier account a merchant connects. No card or bank details | United States |
| Codat | Codat Limited | Connecting a merchant’s accounting software that the Services do not connect to directly, such as QuickBooks Desktop, NetSuite, Sage, FreshBooks, Zoho Books or Wave, and posting the merchant’s sales, refunds, fees and payouts to it | The workspace’s name and identifier; for each order, its number, date, line items, shipping, discount, sales tax and total, with the buyer’s name and email address in the order’s note; refunds, Aglyn’s fee on each sale, and the merchant’s Stripe payouts; or, in daily-summary mode, one journal of each day’s totals in place of the per-order records. No card data | United Kingdom |
Related services
- Google Workspace (Google LLC) — inbound/human email for @aglyn.com (e.g., support, contact). May process email you send to us.
- Google Cloud DNS (Google LLC) — DNS management for aglyn.com domains.
Change log
- October 19, 2026 — Updated Vercel Inc.: as Aglyn’s registrar partner, it now also searches, registers, renews and transfers domain names customers buy through the Services and hosts their DNS, and it receives the names customers search for and, for a name a customer buys, the registrant’s contact details, which it passes to the registrar that sponsors the name and to the domain’s registry. The Notes now say that those registrars and registries, and a customer’s own DNS provider used for one-click DNS, are not Aglyn subprocessors. No subprocessor was added or removed.
- October 14, 2026 — Updated Meta Platforms, Inc. (Meta Pixel), LinkedIn Corporation (LinkedIn Insight Tag) and Google LLC (Google Ads): for account holders in the United States, Aglyn also sends each a hashed (one-way scrambled) copy of the account email address, so Aglyn’s own ads can be shown to, or kept from, people who already have an account, as the Privacy Policy describes. No subprocessor was added or removed.
- October 13, 2026 — Generalized the Google Cloud Logging entry: it now describes the categories of diagnostic information that browser error reports contain, rather than listing individual fields. No subprocessor was added or removed.
- October 8, 2026 — Added Google LLC (Google Cloud Vertex AI) for AI image generation: when a user creates an image in the media library, the description they write and the shape they choose are sent to Google's image models on Google Cloud Vertex AI, which processes each request at a location Google selects anywhere in the world, and the generated image is stored in the customer's media library.
- October 7, 2026 — Added Twilio Inc. (text messages a site sends its own customers about their orders), Popout, Inc. (Shippo) and Simpler Postage, Inc. (EasyPost) (shipping rates, labels, address validation and tracking), and Codat Limited (connecting accounting software the Services do not connect to directly, and posting a merchant’s sales, refunds, fees and payouts to it). They are listed ahead of use: none of them receives data until its feature is turned on. Removed Avalara, Inc. and TaxJar, which were also added on this date: they act in a merchant’s own Avalara or TaxJar account, with the merchant’s own credentials. The introduction now says that shipping, fulfillment, post-purchase and sales tax services a merchant connects with its own account, such as Easyship, Sendcloud, ShipperHQ, ShippingEasy, ShipBob, Amazon Multi-Channel Fulfillment, AfterShip, Route, Narvar, Avalara or TaxJar, act for that merchant and are not Aglyn subprocessors.
- October 7, 2026 — Generalized the entries above: each now states its purpose and the categories of data it receives, rather than listing individual features, pages or devices. Google Fonts: published sites now serve their own fonts, so only the Aglyn site editor and the payment form in a site’s checkout request fonts from Google. Apple Push Notification service also delivers to Aglyn’s apps on Mac. No subprocessor was added or removed.
- October 7, 2026 — Added Apple Push Notification service (Apple Inc.) and Firebase Cloud Messaging (Google LLC) to deliver push notifications to the Aglyn mobile apps.
- October 5, 2026 — Anthropic: AI assistance in the CRM now receives the opened record with all of its standard and custom fields, including contact details, postal addresses, marketing consent, notes, timeline and related records. No new subprocessor.
- September 17, 2026 — Updated Anthropic, PBC: the row now names automations among the drafts AI generation creates, and explanations of a site's automations and their failed runs; product copy, draft products, and store categories and discounts among what AI generation proposes; AI insights, which answer a customer's questions about its own figures and write a weekly summary for members who ask; and AI assistance in the CRM — record summaries with suggested next steps, one-to-one email drafts, and import column matching. It also names the data each of these sends, including a product's first photo as a reduced copy with its metadata removed and the tables of totals AI insights sends.
- September 15, 2026 — Updated Anthropic, PBC: its purpose and the data it receives now cover AI generation, which creates drafts and proposals for a customer's site from a brief, and the changes the Aglyn Assist helper proposes in the site editor. Updated Wistia, Inc.: on a page built to show a single film, the player now loads with the page for visitors whose privacy choices permit analytics; otherwise it still loads only when a visitor presses play.
- September 13, 2026 — Added Wistia, Inc. (hosting and streaming Aglyn’s own films on aglyn.com, loaded only when a visitor presses play).
- August 27, 2026 — Added Meta Platforms, Inc. (advertising measurement through the Meta Pixel) and LinkedIn Corporation (advertising measurement through the LinkedIn Insight Tag); the Meta Pixel was already in use when this entry was published. Updated the Google Analytics entry: the property is linked to Aglyn's Google Ads account with personalized advertising enabled, and Google signals and ads personalization are allowed in every region.
- August 24, 2026 — Added Linear (filing and triage of issue reports submitted through the console's "Report an issue" dialog); this subprocessor was already in use when this entry was published. Removed the thirty-day advance-notice commitment for new subprocessors and the objection window that ran with it; Section 7.2 of the DPA is amended to match.
- August 18, 2026 — Added Google Analytics (analytics for Aglyn's own properties), Google Fonts (web fonts on published sites), and Google Cloud Logging (browser error reports); added Anthropic for AI-assisted features, including the Aglyn Assist helper. Aligned this list with the DPA, the Privacy Policy, and the trust page. Stated the 30-day advance-notice period for new subprocessors and the objection route, matching DPA Section 7.2.
- August 13, 2026 — Verified provider entities and processing locations; corrected the Resend entity name; reconciled this list with the trust page.
- August 5, 2026 — Initial publication.
Notes
- Payment card data is collected and processed directly by Stripe under its own terms; Aglyn does not store full card numbers.
- For commerce features, sales are processed through Aglyn's own Stripe account and the Customer merchant's share is transferred to a connected Stripe Connect account held in the merchant's name (Terms of Service Section 10.2). Stripe acts as an independent controller/processor for that payment processing under its own agreements with Aglyn and with the merchant.
- For domain names a customer buys through the Services, the ICANN-accredited registrar that sponsors the name (currently Name.com, Inc. or Tucows Domains Inc.) and the registry that operates its ending, which may be outside the United States, receive the registrant’s contact details through Vercel and hold them as the domain’s registrant record under ICANN’s rules and their own terms (Terms of Service Sections 4.12 to 4.14). They act as independent controllers, not as Aglyn subprocessors. When a customer uses one-click DNS (Domain Connect) for a domain registered elsewhere, Aglyn sends the domain name to that customer’s own DNS provider, which acts for the customer and is not an Aglyn subprocessor.
© 2026 Aglyn LLC. All rights reserved.