Subprocessors
Every third party that processes personal information on our behalf, what it does, and where it runs.
Why this page existsA privacy policy that says "we share data with trusted partners" tells you nothing. This is the actual list, with what each one does and what reaches it.
Section 1The current list
| Provider | What it does for us | What reaches it | Where |
|---|---|---|---|
| Vercel Inc. | Hosts this website and our web applications, and runs the form endpoint | Anything submitted through a form, plus request logs including IP address | United States |
| Supabase Inc. | Database, authentication and file storage for our applications | Account records and the content you create in an application | United States |
| OpenAI, L.L.C. | Identifies an item from photographs and drafts a listing description | The photographs you take or pick in an application, and the item details you entered alongside them | United States |
| Zink Media, LLC (Discogs) | Looks up music catalog data | Search terms only, such as an artist, a title or a catalog number | United States |
| Functional Software, Inc. (Sentry) | Collects crash and error reports from our applications | Device model, operating system, application version and the technical detail of the error. Collection of personal information is switched off | United States |
| Resend (Plus Five Five, Inc.) | Delivers messages sent through this website to our inbox | Your email address, your name and the content of the message | United States |
| Microsoft Corporation | Hosts the mailbox those messages arrive in | Your email address, your name and the content of the message | United States |
| Stripe, Inc. | Takes payment for anything bought directly from us | Your card details, which they hold and we never see, plus billing name and country | United States |
| Apple Inc. | Distributes our iOS applications, takes payment for in app purchases, and delivers push notifications and Sign in with Apple | Purchase and subscription status, tied to an identifier rather than to your name | United States |
| Google LLC | Distributes our Android applications, takes payment for in app purchases, and delivers push notifications through Firebase Cloud Messaging and Sign in with Google | Purchase and subscription status, tied to an identifier rather than to your name | United States |
| Shopify Inc. | Hosts the merchant platform our Shopify applications run on | Store details and the specific data an application asked the merchant permission for | Canada and United States |
Not every provider is involved in every product. A free app with no account touches almost none of them, and each application’s own supplement says which apply to it.
The one provider on this list that is an AI service
Apple and Google both ask that this be stated separately rather than left in a row of a table, and it is a fair thing to ask. OpenAI is the only artificial intelligence service we send anything to. An application sends it the photographs you took and the details you entered, and it sends back an identification and a draft description.
Under OpenAI’s terms for their programming interface, what we send is not used to train their models. They may hold it for a short period to check for abuse of the service, and then it is removed. Nothing is sent to any AI provider except the photographs and details belonging to the item you are working on.
A service you connect yourself is not on this list, and should not be.A subprocessor is a company we hand your data to in order to run our service. When you link an AI assistant, an automation platform or your own software to one of our applications, you are choosing that provider and the data goes to it on your instruction, under your agreement with them rather than ours. We are not passing it on, so they are not processing on our behalf. The same holds for anywhere that service sends it next. Section 18 of the Privacy Policy sets out exactly how that works and what it means for you.
Section 2What every one of them is held to
Before a provider joins this list, and for as long as it stays on it:
- there is a written contract that limits it to processing on our instructions;
- it receives only the data its job actually requires, never a full copy of everything;
- it may not use the data for its own purposes, including training its own models;
- it is bound to confidentiality and to security measures at least as strong as ours;
- it must tell us about a breach quickly enough for us to meet our own notification deadlines;
- it must delete or return the data when we stop using it.
Section 3How we announce a change
When we add a provider that will process personal information, we update this page and bump its version before the provider goes live. Business customers and merchants under a Data Processing Addendum get at least 30 days' notice by email and can object during that window. If we cannot resolve a reasonable objection, they may end the affected service without penalty.
Removing a provider needs no notice, because it only ever reduces where data goes.
Section 4Who is deliberately not on this list
What is missing matters as much as what is present. We do not use any of the following, anywhere:
- advertising networks or advertising SDKs;
- cross site tracking or attribution services;
- data brokers or enrichment services that append information about you from elsewhere;
- session recording tools that replay what you did on a screen;
- analytics that build a profile of you across different websites.
Our website analytics set no cookies and record no personal identifiers, which is why no analytics provider appears above as a processor of personal information.
Section 5International transfers
Native Code LLC is in the United States and so is almost all of this infrastructure. For information covered by United Kingdom or European law, transfers rely on the Standard Contractual Clauses and the United Kingdom Addendum, with encryption in transit and at rest as an additional safeguard. This is set out in the Privacy Policy and in the Data Processing Addendum.