Subprocessors
About this list
Last updated: 2026-11-01.
These are the companies that may process personal data of your shoppers or staff on our behalf when you use any Cloudlift app. This list is Annex 2 of our Data Processing Agreement; section 7 of the DPA governs it.
Changes to this list, including the notice period and your right to object, follow section 7 of our DPA. We announce each change with a notice in the app admin, and by email if you ask for it at privacy@cloudlift.app.
Every subprocessor is bound by written data protection terms at least as protective as our DPA, and we remain responsible for their work.
Shopify is not on this list because you contract with it directly. Providers that process only our own business data (support desk, email, product analytics) are named in our Privacy Policy.
Subprocessors
Hosting runs on Google Cloud. The AI providers receive data only when your staff use an AI feature in the app admin or your shoppers use an AI option you enabled. If no AI feature is enabled, no uploaded files, file names or order data are sent to AI providers.
| Subprocessor | Purpose | Personal data | Processing location | Transfer safeguard | Terms |
|---|---|---|---|---|---|
| Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland | Hosting and file storage | All categories in DPA Annex 1, of shoppers and your staff | Customer data in your shop's storage location: United States by default, or the EU or Asia where chosen. App configuration in the United States | Contracting entity in the EU. Google LLC is certified under the EU-US DPF, UK Extension and Swiss-US DPF; DPA includes EU SCCs with Swiss and UK supplements | DPA, subprocessors |
| Google Cloud EMEA Limited (Gemini API, paid tier) | AI features: the AI assistant and AI actions in the app admin, and AI options you enable in your storefront | Prompts and the content sent with them, entered by your staff or, for storefront AI options, by the shopper | Wherever Google operates facilities | As Google Cloud | Processor terms, API terms |
| Anthropic Ireland, Limited, South Bank House, Barrow Street, Dublin 4, Ireland | AI features: the AI assistant and AI actions in the app admin, and AI options you enable in your storefront | Prompts and the content sent with them, entered by your staff or, for storefront AI options, by the shopper | Inference worldwide, data stored in the United States | Contracting entity in the EU; onward transfers under the EU SCCs with UK and Swiss addenda | DPA, subprocessors |
| OpenAI Ireland Ltd., 117-126 Sheriff Street Upper, Dublin 1, Ireland | AI features: the AI assistant and AI actions in the app admin, and AI options you enable in your storefront | Prompts and the content sent with them, entered by your staff or, for storefront AI options, by the shopper | Inference worldwide, data stored in the United States | Contracting entity in the EU; onward transfers under the EU SCCs with the UK Addendum | DPA, subprocessors |
Each provider's own subprocessors are listed on the page linked in its row; we review them when we update this list.