Subprocessors
Every third party that processes personal data on our behalf, published in full as Article 28(2) of the GDPR expects.
On this page 3 sections
Current subprocessors
| Provider | What it does | What it handles | Where |
|---|---|---|---|
| Google Cloud / Firebase | Application database, authentication and file storage | All customer and account data | United States |
| Vercel | Application hosting and content delivery | Request metadata, IP addresses | United States (global edge) |
| Stripe | Subscription billing, card payments on vendor invoices, and vendor payout accounts (Stripe Connect) | Billing contact, payment method (held by Stripe); for a vendor who opens a payout account, the identity, business and bank details Stripe collects directly | United States |
| Resend | Transactional email delivery | Recipient address, message content | United States |
| Google (Gemini API) | AI bid evaluation, the Gero assistant and account-verification research (primary provider) | Submitted text, attachments and screenshots sent for analysis; for account applications, the application details and uploaded registration documents, researched against public sources with Google Search grounding; requests are made with storage disabled | United States |
| OpenAI | AI bid evaluation and the Gero assistant (fallback when Gemini is unavailable, and for Word/PowerPoint attachments); reading account-application documents when Gemini is unavailable | Submitted text and attachments sent for analysis; requests are made with storage disabled | United States |
Each provider’s own privacy documentation: Google Cloud / Firebase, Vercel, Stripe, Resend, Google (Gemini API), OpenAI.
Every one is engaged under written terms that limit them to processing on our instructions, and transfers out of the EEA or UK rely on Standard Contractual Clauses. Fonts are served from our own domain rather than a font CDN, so using Magemcy does not send a request to a third party you did not choose.
Changes and objections
We will update this page before a new subprocessor starts handling customer data, and notify customers who have asked to be told. If you object on reasonable data-protection grounds, write to our privacy contact and we will work with you, or, if we cannot, you may terminate the affected subscription.
Who is not on this list
Worth stating explicitly, because the absences are the point: there is no advertising network, no data broker, no analytics provider, no session-recording tool and no marketing-automation platform in this product. If any of that changes, it appears here first.
Related: Data Processing Addendum, GDPR, Privacy Notice.
Questions about this policy?
A person reads every message. Get in touch and we’ll answer. Or ask Gero, our AI assistant, to walk you through what this page says - the answers explain, they don’t bind.