OneTrueTagOneTrueTag Sub-processors
Version: [[VERSION]] · Effective date: [[EFFECTIVE_DATE]] · Last updated: 2026-10-14 (draft)
This list is Annex 3 of the data processing agreement. It names the third parties that process Customer Data on OneTrueTag's behalf (Section 1), the parties that are not sub-processors but receive data in connection with the Service (Sections 2 and 3), and the outside services that receive no personal data (Section 4).
Changes are announced as described in Section 5.
1. Sub-processors
| Sub-processor | Service | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| [[HOSTING_PROVIDER]] | Servers for the API, the panels, the PostgreSQL database, the Redis cache and the queue workers | All Customer Data and seller account data | [[HOSTING_REGION]] | [[HOSTINGTRANSFERSAFEGUARD]] |
| [[STORAGE_PROVIDER]] | S3-compatible object storage for files (logos, product media, guides, customer uploads, print files) | Files, including photos and documents End Customers upload | [[STORAGE_REGION]] | [[STORAGETRANSFERSAFEGUARD]] |
| [[EMAIL_PROVIDER]] | Sending transactional email (sign-in, notifications, tracking links, scheduled reports, offer emails) | Recipient email address, name, email content | [[EMAIL_REGION]] | [[EMAILTRANSFERSAFEGUARD]] |
No other sub-processor is used. OneTrueTag does not use third-party error monitoring, analytics or advertising services in the panels.
2. Independent controllers
These parties receive personal data in connection with the Service but decide their own purposes and means, under their own terms and privacy notices.
| Party | Role | Data |
|---|---|---|
| Paddle.com Market Limited and its affiliates | Merchant of record for paid plans: checkout, payment, tax, invoices. Its checkout script loads in the brand panel only when checkout opens | Seller's billing contact, payment and tax data |
| Google LLC / Google Ireland Limited | "Sign in with Google", only when a person chooses it | The identity Google returns (name, email, Google account id, profile photo) |
3. Services the Customer connects
These services are chosen, connected and paid for by the Customer (the brand), under the Customer's own agreement with each provider. They are not OneTrueTag's sub-processors. OneTrueTag exchanges data with them only on the Customer's instruction, through the connection the Customer sets up, and stops when the Customer disconnects.
| Service | What OneTrueTag sends or receives |
|---|---|
| Telegram (Telegram Bot API) | Messages, buttons and files to and from End Customers who write to the Customer's bot; the bot reads the profile details Telegram shares with bots |
| Meta Platforms (WhatsApp Business Platform, Cloud API) | Messages, templates and files to and from End Customers, through the Customer's own WhatsApp Business account; delivery receipts |
| Other WhatsApp providers (360dialog, Vonage, Infobip, Twilio), only where enabled for an existing number | The same, through the Customer's own provider account |
| Shopify, WooCommerce, Amazon Selling Partner API, Salla, Zid, Trendyol | Read-only product, variant and category data. Orders and customer data are never read |
| HubSpot, Salesforce, GoHighLevel | End Customer name, email, phone, country and city, purchase channel, SKUs, warranty status and end date, news consent. Never chat ids, photos, addresses, messages, notes, tickets or repairs |
| AI providers: Anthropic (Claude), OpenAI, Google (Gemini), Chatbase, Voiceflow, Botpress, or the Customer's own endpoint | The End Customer's question and the conversation so far, the product's name, and the product's guides and FAQ (for the three model providers). With OpenAI, requests are sent with storage turned off |
| AI clients connected to the MCP server (for example claude.ai, ChatGPT, Claude Desktop, Cursor, VS Code) | Whatever the connected Member asks the client to read or change, within that Member's permissions |
| The Customer's own webhook endpoints | Event type and record ids only; no personal data |
4. Outside services that receive no Customer Data
| Service | Use |
|---|---|
| MaxMind GeoLite2 City database | Country and city lookup. The database file is downloaded weekly and queried on our own servers; no address is sent to MaxMind |
| Map tiles ([[MAPTILEPROVIDER]]; in development OpenStreetMap's tile server) | Draws the map on the repair form's pickup point. The End Customer's browser loads the map images directly from the tile provider, which therefore sees the browser's IP address and the map area viewed |
| Public DNS-over-HTTPS resolvers (Cloudflare, Google) | Checking that a Customer's custom domain points to us; only the domain name is sent |
| A public certificate authority | TLS certificates for Customers' custom domains; only the domain name is sent |
The map-tile provider receives an IP address but processes it as an independent provider of a public map service. It is listed here for transparency.
5. Changes
5.1 OneTrueTag will announce a new or replacement sub-processor at least 30 days before it starts processing Customer Data, by email to the Account owner and by updating this page.
5.2 The Customer may object on reasonable data-protection grounds within that period, as set out in Section 7 of the data processing agreement.