Sub-processors
Provider: STL EMBEDED CREATIONS SRL, Cluj-Napoca, Romania.
This list is Annex III of the Data Processing Addendum. It covers personal data that Consentl processes on behalf of its customers in both services:
- Consentl for Shopify: the Shopify app at
shopify.consentl.com; - Consentl for websites: the dashboard at
app.consentl.comand the public API atapi.consentl.comthat the website snippet and the platform plugins call.
That data is store and website visitors' consent records, privacy requests, withdrawals and the e-mails sent to them. The same providers also process the data for which we are the controller (customer accounts, billing, support, logs); that is described in our privacy policies.
Version 3 · Effective: 2026-10-23
Current sub-processors
| # | Sub-processor (entity, seat) | Used for | Service and processing | Data concerned | Location of processing | Transfer safeguard |
|---|---|---|---|---|---|---|
| 1 | DigitalOcean, LLC, New York, USA | Shopify and websites | Hosting: App Platform (web applications, scanner worker, pre-deploy jobs), Managed PostgreSQL databases, automated database backups, runtime logs | All data in the Consentl databases (DPA Annex I) and request metadata in logs | Frankfurt, Germany (App Platform region fra, database cluster in fra1) |
Data at rest in the EU. Remote access from third countries (support, operations) under DigitalOcean's data processing agreement, which incorporates the EU Standard Contractual Clauses (2021/914) and the UK Addendum. |
| 2 | Cloudflare, Inc., San Francisco, USA, engaged by DigitalOcean (sub-processor of DigitalOcean) | Shopify and websites | The App Platform edge: TLS termination, content delivery, DDoS and bot protection for every request to shopify.consentl.com, app.consentl.com, api.consentl.com, consentl.com and their staging hosts. It may set the security cookie __cf_bm (30 minutes) on these hosts. Consentl's country lookup for the banner runs on Consentl's own servers (local DB-IP Lite database), not at Cloudflare. |
Visitor and customer IP addresses, request metadata, request bodies in transit (consent beacons, form submissions) | Global edge network (the data centre nearest to the requester); request bodies are not stored | The Standard Contractual Clauses that DigitalOcean concludes with Cloudflare under DigitalOcean's data processing agreement. |
| 3 | Brevo SAS (formerly Sendinblue SAS), 106 boulevard Haussmann, 75008 Paris, France | Shopify and websites | Transactional e-mail through the Brevo API: privacy-request verification and confirmation, withdrawal acknowledgements (to shoppers and visitors); notifications, scan reports and account and billing e-mails (to customers) | Recipient e-mail address and name, e-mail content (may include order numbers, the request type and the requester's message), delivery, bounce and complaint events (open and click tracking anonymised) | European Union | EU provider; no transfer by Consentl. Brevo's own sub-processors: see Brevo's published list. Open and click tracking is anonymised: no engagement data is linked to the recipient. |
| 4 | Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland | Shopify and websites | E-mail hosting of the consentl.com mailboxes [email protected] (support) and [email protected] (data protection; also the sender of our transactional e-mails): support and privacy correspondence, requests that customers forward to us, replies, bounces and auto-replies to our e-mails | E-mail addresses, names and messages of customers, of shoppers and visitors who reply to our e-mails, and of shoppers and visitors whose requests customers forward | Switzerland | Adequacy decision of the European Commission for Switzerland (2000/518/EC). In use since 2026-10-22 (both mailboxes live). |
Not sub-processors (for transparency)
| Party | Used for | Why it is not a sub-processor |
|---|---|---|
| Shopify (Shopify International Limited, Dublin, Ireland; Shopify Inc., Ottawa, Canada) | Shopify | The platform on which the merchant runs the store and installs the app. Shopify processes store data under its own agreement with the merchant, forwards app-proxy requests and webhooks, hosts the storefront scripts on its CDN and bills the app. On the merchant's instruction we pass data to Shopify as the merchant's own platform (opt-outs of sale or sharing, forwarded erasure requests, the published banner configuration); we do not engage Shopify to process data on our behalf. |
| Website platforms (WordPress, Shopware, PrestaShop, Magento, website builders, Google Tag Manager) | Websites | The customer's own platform. Our plugins and templates run there and store no visitor data; we do not engage the platform. |
| Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland) | Websites (billing) | Processes our customers' billing and payment data (account e-mail, name, payment details, billing address, tax ID) for us and, for fraud prevention and its regulatory duties, as an independent controller. It receives no visitor data. Described in the privacy policy for websites. |
| DB-IP (db-ip.com) | Websites | Publisher of the DB-IP Lite country database (CC BY 4.0). A copy is built into our servers and the country lookup runs there, in memory; DB-IP receives no data from us. |
| Google (Google Ireland Limited, Dublin, Ireland; Google LLC, USA) | Our own website consentl.com only | Google Analytics 4 runs only on consentl.com and only after the visitor accepts analytics. It processes data of our website's visitors as our processor; it never receives data of our customers' stores, websites or visitors. Described in the website privacy notice. |
| GitHub, Inc., San Francisco, USA | Development | Hosts the source code and CI. No production personal data is placed in the repository, issues, pull requests, CI logs, test fixtures or screenshots. |
| AI coding assistants (for example Claude by Anthropic PBC, USA) | Development | Used by our personnel on source code and test data only; not given production databases, production logs or customer personal data. If an AI tool is ever given access to production data or logs, its provider is added to the table above with 30 days' notice first. |
Change notification mechanism
- Advance notice. At least 30 days before a new sub-processor starts processing customer
personal data (or an existing one is used for a new purpose or location), we:
- add an entry to the change log below with the planned effective date;
- send an e-mail to the Notice Address of every customer: for Shopify, the privacy contact the merchant set in the app or, if none, the store owner's e-mail address; for websites, the notice address set on the Account page or, if none is confirmed, the account owners and admins. Subject: "Consentl: planned sub-processor change".
- Objection. The customer may object in writing to [email protected] within the notice period, on reasonable grounds relating to data protection. We answer within 14 days and try to resolve the objection (for example by not using the sub-processor for that customer). If the objection is not resolved within 30 days, the customer may terminate before the change applies to it; prepaid fees for the unused period are refunded (DPA sections 6.3 and 6.4: through Shopify as a refund or app credit, or through Stripe).
- Emergency replacement. If a sub-processor must be replaced urgently (security incident, insolvency, termination by the sub-processor), we may make the change with shorter notice and inform customers as soon as possible. The objection right still applies, and a refund is calculated from the date of the change.
- Other addresses. Customers who want notices at another address can tell us at [email protected].
Change log
| Date | Change | Notice sent | Effective |
|---|---|---|---|
| 2026-10-20 | Initial list (DigitalOcean, Cloudflare via DigitalOcean, Brevo). | — (before launch) | at launch |
| 2026-10-21 | Version 2: the list covers Consentl for websites as well; Cloudflare entry corrected (role, hosts, no country lookup); Brevo entity name updated; Proton AG added for the consentl.com mailboxes; Stripe, Google, website platforms and AI coding assistants listed as not sub-processors. | — (before launch) | at launch; Proton from the date its mailboxes go live |
| 2026-10-22 | Proton AG entry extended: it hosts both public addresses, [email protected] and [email protected], including support correspondence and requests that customers forward. No other mailbox provider is used. | — (before launch) | 2026-10-22 (mailboxes live) |
| 2026-10-22 | Pre-publication review: Cloudflare entry updated (bot protection and the __cf_bm cookie, consentl.com host; the country lookup runs on our own servers with the DB-IP Lite database); DB-IP listed as not a sub-processor; Stripe in live mode, contracting entity Stripe Payments Europe, Limited; notice recipients follow the notice-address settings of both services. |
— (before launch) | at launch |
| 2026-10-23 | Version 3, first published version: the list as above, with the owner's confirmations (AI coding assistants never receive production data or logs; Brevo with anonymised open and click tracking). No new sub-processor. | — (first publication) | 2026-10-23 |
Source: docs/legal/SUBPROCESSORS.md in the Consentl repository.