Subprocessor List
Lawyer-review draft — last updated 28 August 2026.
These providers support Upsell Me. Their role depends on the feature and deployment used. They do not receive card data from Marvello.
| Provider | Purpose | Data and location |
|---|---|---|
| Shopify Inc. and affiliates | Commerce platform, app installation and authentication, APIs, webhooks, extensions, app billing and customer privacy requests. | Shop, user, catalogue, checkout, order and customer data controlled by Shopify and the merchant; processed in locations described by Shopify's terms. |
| Google Cloud / Google affiliates | Application hosting, managed database, secret management, encrypted backups and bounded operational logging. | Upsell Me application data; the current verified service region is Sydney, Australia (australia-southeast1), while support and provider operations can involve other locations under Google's terms. |
| Cloudflare, Inc. and affiliates | DNS, network security, public-site delivery, protected ingress and owner-console access controls. | Request and security metadata processed through Cloudflare's global network; public marketing pages contain no merchant or customer records. |
Changes
Marvello will update this page before or promptly after a material provider change and, where reasonably practicable and required by the DPA, give advance notice. Merchants may send a reasoned data-protection objection within 14 days.
Not currently used for live customer processing
No public merchant billing integration, customer email service, advertising network or independent product analytics provider is represented here as active. That must change before any such provider is enabled.