Sub-processors

Last updated: 25 October 2026

These are the companies that process customer data for CatalogBadge, under our data processing agreement. The list is checked against our code on every change, so it names only services we actually use. We email account owners at least 30 days before we add or replace one. Where each one keeps data is in the data location statement.

Sub-processors

Cloudflare, Inc.

What it does: Hosting, database, file storage, queues, image rendering (Browser Run), background removal containers, sign-in protection (Turnstile, Access), email sending, website analytics without cookies, logs
Data it sees: Everything the service holds: account details, feeds and product data, photos, rendered images, feed files, billing status, form requests
Where: United States (global network)
When: Always

Anthropic, PBC

What it does: Suggesting short labels and ad titles (AI text)
Data it sees: A product's title, brand and a short excerpt of its description. Never prices, account details, emails, feed URLs or photos
Where: United States
When: Only for stores that turn AI text on. Anthropic does not train models on API data

Backblaze, Inc. (B2)

What it does: Off-site database backups
Data it sees: A nightly copy of the database and of store logos, encrypted before upload with a key Backblaze never has
Where: United States (US East)
When: Always; kept up to 3 months

GitHub, Inc. (Actions)

What it does: Runs the nightly backup job and our deploys
Data it sees: The database copy passes through a temporary GitHub runner for a few minutes while it is encrypted; nothing is kept there
Where: United States
When: Nightly

Figma, Inc.

What it does: Importing a design you share from Figma
Data it sees: We read the Figma file you point us to. We send Figma nothing from your store
Where: United States
When: Only when you ask us to import a design

Better Stack, Inc.

What it does: Uptime monitoring and missed-job alerts
Data it sees: No customer data: a ping with no content every few minutes, and a check of our public health page
Where: United States and EU
When: Always

Independent companies you deal with

These two act on their own account, under their own privacy policies, not as our processors. We list them so the picture is complete.

Dodo Payments

What it does: Sells the subscription as merchant of record: payment, tax, invoices
Data it sees: What you enter at checkout. We send Dodo your email and plan; we receive your customer and subscription IDs and status
Where: Worldwide (see Dodo's privacy policy)
When: Paid plans and trials

Google LLC

What it does: Sign in with Google
Data it sees: Google tells us your email, name and Google account ID; we send Google nothing else
Where: United States
When: Only if you choose Google sign-in

Meta Platforms, Inc.

What it does: The performance readout you switch on: reads your ad results per design and per product, and, with the separate catalog switch, your catalog's upload errors and rejected products
Data it sees: Read-only. We send Meta nothing but the sign-in you approve; we receive a token (sealed at rest, deleted when you disconnect), your ad set names and results, and the catalog's verdict by product ID
Where: United States and Ireland (see Meta's privacy policy)
When: Only when you connect Meta on the Performance page

Salla

What it does: The Salla app you install: reads your products to build your feeds
Data it sees: Read-only. We send Salla nothing but the access you approve; we receive a token (sealed at rest, deleted when you uninstall), your store's name, currency and country, the owner's email, and your products
Where: Saudi Arabia (see Salla's privacy policy)
When: Only if you install CatalogBadge from the Salla app store

Zid

What it does: The Zid app you install: reads your products to build your feeds
Data it sees: Read-only. We send Zid nothing but the access you approve; we receive a token (sealed at rest, deleted when you uninstall), your store's name, currency and country, the owner's email, and your products
Where: Saudi Arabia (see Zid's privacy policy)
When: Only if you install CatalogBadge from the Zid app store

YouCan

What it does: The YouCan app you install: reads your products to build your feeds
Data it sees: Read-only. We send YouCan nothing but the access you approve; we receive a token (sealed at rest, deleted when you uninstall), your store's name and currency, and your products
Where: Morocco (see YouCan's privacy policy)
When: Only if you install CatalogBadge from the YouCan Marketplace

BigCommerce

What it does: The BigCommerce app you install: reads your products to build your feeds
Data it sees: Read-only. We send BigCommerce nothing but the access you approve; we receive a token (sealed at rest, deleted when you uninstall), your store's name, address, currency, country and timezone, and your products
Where: United States (see BigCommerce's privacy policy)
When: Only if you install CatalogBadge from the BigCommerce App Marketplace

Wix

What it does: The Wix app you install: reads your Wix Stores products to build your feeds
Data it sees: Read-only. We send Wix nothing but our app's credentials and your site's app instance id; we receive a short-lived token (sealed at rest, deleted when you uninstall), your site's name, address and language, and your products; product photos load from Wix's image server
Where: Israel (see Wix's privacy policy)
When: Only if you install CatalogBadge from the Wix App Market

Squarespace

What it does: The Squarespace key connection you make: reads your products to build your feeds
Data it sees: Read-only. We send Squarespace nothing but the read-only key you paste; we receive your store's name, currency and country, and your products. The key is sealed at rest and deleted when you disconnect
Where: United States (see Squarespace's privacy policy)
When: Only if you connect a Squarespace store with an API key

Ecwid by Lightspeed

What it does: The Ecwid by Lightspeed key connection you make: reads your products to build your feeds
Data it sees: Read-only. We send Ecwid by Lightspeed nothing but the read-only key you paste; we receive your store's name, currency and country, and your products. The key is sealed at rest and deleted when you disconnect
Where: United States (see Ecwid's privacy policy)
When: Only if you connect an Ecwid store with a secret token

Not on this list

Meta, Snapchat, TikTok and Pinterest fetch the feeds and images you give them; they are your own advertising partners, not ours, and we never sign in to your ad accounts. Your store platform (Salla, Zid, Shopify and the like) is where we read your feed from. Questions: hello@catalogbadge.com.