Legal
Sub-processors
The providers that process personal data for Tallrung, and the Merchant’s own accounts that are not ours.
Effective 11 November 2026
1.About this list
These are the providers that Tallrung engages to run the Services and that may process personal data for it. For Buyer Data, they are our sub-processors under the Data Processing Agreement. For Merchants’ own account data, they are our processors under the Privacy Policy.
We tell Merchants by email at least 30 days before a new sub-processor processes Buyer Data, as the DPA says. To object, write to privacy@tallrung.com.
2.Our sub-processors
| Provider | What it does | Where it processes | Transfer mechanism | Buyer Data |
|---|---|---|---|---|
| Vercel Inc. | Hosts the app, the landing page, and every funnel site, and runs the server code, the scheduled jobs, and the headless browser that checks pages before they publish. Stores uploaded and generated images (Vercel Blob). Connects custom domains. Runs the bot check on the sign-up form (Vercel BotID). | United States (server code in US East). Requests pass through Vercel's worldwide edge network, including EU locations. | EU-US Data Privacy Framework (Vercel Inc. is certified), and the Standard Contractual Clauses in Vercel's DPA. | Yes |
| Neon (Neon, LLC, and its parent Databricks, Inc.) | Hosts the database that holds every record of the Services, on Amazon Web Services. | United States (AWS us-east-1, Northern Virginia). | EU-US Data Privacy Framework (Databricks, Inc. is certified, and its certification covers Neon, LLC). | Yes |
| Google LLC | Suggests and completes shipping addresses as a Buyer types at checkout (Google Places API). Our server sends the typed text, never the Buyer's IP address. | United States and Google's other locations. | EU-US Data Privacy Framework (Google LLC is certified), and the Standard Contractual Clauses in Google's data processing terms. | Yes: the address text a Buyer types |
| Resend (Plus Five Five, Inc.) | Sends the Services' own emails to Merchants and their members: sign-up confirmations, password resets, invitations, trial and billing notices, and low-credit warnings. | United States. | EU-US Data Privacy Framework (Plus Five Five, Inc. is certified), and the Standard Contractual Clauses in Resend's DPA. | No |
| OpenRouter, Inc. | Runs the AI models that write pages, read images, and make images, from what a Merchant gives the Services: product details, the brand profile, pages, pages to copy, and images. It passes each request to an AI model provider, a company that runs AI models on its own servers. We don't choose which provider serves a request. | United States (OpenRouter). The model providers may be in the United States and in other countries outside the EU. | Standard Contractual Clauses (Module 2) in OpenRouter's DPA. OpenRouter isn't certified under the EU-US Data Privacy Framework. | No |
| Atlas Cloud (ATLAS CLOUD AI INC.) | Makes and edits images for pages, from the Merchant's prompts and product photos. | United States (New York). | Standard Contractual Clauses, in the DPA that Atlas Cloud gives its customers on request, which we are putting in place. Until it is signed, we send Atlas Cloud only prompts and product photos, never account data or Buyer Data. | No |
| Stripe (Stripe Payments Europe, Ltd., and Stripe, LLC) | Bills our plans and credit purchases, on our own Stripe account: Checkout, the billing portal, saved cards, invoices, and tax IDs. Card numbers are held by Stripe only. | Ireland and the United States. | EU-US Data Privacy Framework (Stripe, LLC is certified), and the Standard Contractual Clauses in Stripe's DPA. | No |
3.The Merchant’s own accounts
These providers aren’t our sub-processors. The Merchant connects its own account with each one and chooses to send it data, under the Merchant’s own agreement with the provider. For that data, each provider is the Merchant’s processor or an independent controller, as its own terms say.
| Provider | Role | What the Services send it |
|---|---|---|
| Stripe (the Merchant’s connected account) | The Merchant's payment processor, under the Merchant's agreement with Stripe. | Card payments as direct charges: the Buyer's card (in Stripe's own fields), email, name, and address, and the amount. |
| PayPal (the Merchant’s REST app) | The Merchant's payment processor, under the Merchant's agreement with PayPal. | PayPal payments and their vault tokens for one-click upsells, with the order's amount and items. |
| Shopify (the Merchant’s store) | The Merchant's store, under the Merchant's agreement with Shopify. | One order for each completed purchase: the Buyer's email, phone, name, shipping address, and items, for fulfillment and the order email. |
| Meta (the Merchant’s pixel and Conversions API) | The Merchant's advertising partner. Meta is a controller, or the Merchant's processor, under Meta's terms. | Page events from the pixel in the Buyer's browser, and one purchase per order from our server: the total, the hashed email, phone, name, city, region, postal code, and country, the IP address and user agent, and the _fbp and _fbc values. |
| Google (the Merchant’s GA4 and Google Ads) | The Merchant's analytics and advertising partner, under Google's terms. | Page events from the tag in the Buyer's browser, one purchase per order from our server (with the GA client id), and the Google Ads conversion in the browser on the thank-you page. |
| TikTok (the Merchant’s pixel and Events API) | The Merchant's advertising partner, under TikTok's terms. | Page events from the pixel in the Buyer's browser, and one purchase per order from our server: the total, the hashed email and phone, the IP address and user agent, the ttclid, and the _ttp value. |
4.Services loaded in Buyers’ browsers
Some services are loaded by the page itself, so the Buyer’s browser contacts them directly:
- Google Fonts. A page loads the Google Fonts families it names from Google’s servers, so the Buyer’s IP address and browser reach Google. The app itself serves its own fonts.
- Stripe.js and PayPal’s buttons, on the checkout and the upsells, from the Merchant’s own accounts.
- The Merchant’s ad tags, when the Merchant connects Meta, Google, or TikTok.
- Video players (YouTube, Vimeo, or Wistia), when a page embeds a video.
- The Merchant’s custom code, and whatever it loads.
The Cookie Policy lists what each one stores.