Subprocessors

A subprocessor is a third party we rely on to deliver Agentible, and that may process your data on our behalf. We keep the list short on purpose, and we publish all of them here so there are no surprises.

We list two kinds of company separately. A subprocessor processes your data on our instructions, under a contract that binds it to them. A recipient receives data and decides for itself what to do with it, so it is not covered by that chain. Calling the second kind a subprocessor would describe a control we do not have.

• Vercel: Hosting and delivery of the app and the website, plus aggregate visit counts. What they receive: Request metadata, including IP address and user agent, and anything you type into a form on its way to us. Where: United States, with edge delivery worldwide. Since: 2026-06-10.
• Supabase: Database and authentication. What they receive: Your store domain, owner email address, settings, audit results, and the sign-in session behind them. Where: European Union region. Since: 2026-06-10.
• Shopify: The app platform, the source of the product data we audit, and the script that makes the embedded app work in your admin. What they receive: Your store domain and owner email address. Shopify also receives the IP address of anyone loading a page on this site, because the App Bridge script is served from its CDN. Where: Canada and the United States. Since: 2026-06-10.
• Anthropic: Writing product copy with Claude, on the fixes you ask us to generate. What they receive: Product text from your catalogue. No customer data, and no name or email address of yours. Where: United States. Data is not used to train models. Since: 2026-06-10. Note: We evaluate AI vendors on cost and quality. If we switch, this entry updates the day the new vendor starts processing your data.
• Resend: Sending the emails the product sends: welcome, scan complete, fixes ready, billing. What they receive: Your email address, your store domain, and the contents of the message. Where: United States. Since: 2026-07-30.
• Stripe: Payment processing for the small number of stores that did not install through Shopify. If you installed from the Shopify App Store, Stripe receives nothing about you. What they receive: Billing email address and payment details, for non-Shopify stores only. Where: United States and Ireland. Since: 2026-06-10.

• Google: Measuring which of our own adverts produced a customer. We upload a file of click identifiers and the value of the plan bought. What they receive: The click identifier Google itself put on the link you followed, plus the amount and date. No name, no email address, and no product data. Where: United States. Since: 2026-08-04.

This is how we measure our own adverts without putting an advertising tag on the site. Nothing is sent while you browse. A file is uploaded by hand, after the fact, and it contains the identifier the advertising platform itself attached to the link you followed, not anything we learned about you.

Before we add or replace a subprocessor, we update this page and notify active merchants in the app or by email, so you have time to object. To be notified directly, email privacy@agentibleapp.com and ask to be added to the subprocessor notice list.

We did not give that notice, and we are not going to pretend otherwise. The following were processing data for us before this page named them:

• Resend: started 2026-07-30, first listed here 2026-08-07.
• Google: started 2026-08-04, first listed here 2026-08-07.

Separately, Shopify was already on this list, but the reason was incomplete: its CDN serves the App Bridge script from the root of the site, so it receives the IP address of anyone loading any page here, not only merchants using the embedded app. That is now stated above.

The list is no longer written by hand. It is generated from a single definition in the code, and a test fails the build if the app can reach a company this page does not name. That is what stops the next one from slipping through, rather than a promise to be more careful.