Subprocessors
Last updated: November 6, 2026
A subprocessor is a third party we engage to process customer personal data on our behalf. This is the current list under our Data Processing Addendum. We give customers at least 30 days’ notice before a new subprocessor starts processing customer data. Questions? Write to legal@commercebuilds.com.
| Subprocessor | Purpose | Data categories | Location |
|---|---|---|---|
| Vercel, Inc. | Platform hosting, compute, request logs, file storage, and AI Gateway routing for AI features | Platform data in transit and in logs; uploaded images; review text submitted for AI features | United States |
| Neon, Inc. | Primary database | All customer personal data at rest | United States |
| Kinde, Inc. | User identity, authentication, and organization membership | Authorized-user names, emails, and identifiers | United States |
| Clerk, Inc. | User authentication and account management | Account user names, email addresses, authentication identifiers, and session data (business users only, never end customers) | United States |
| Zernio (ARBICHAT, S.L.) | Connects to Google Business Profile on our behalf: reads reviews and publishes replies and posts | Public reviewer names and review text, business profile data, Google Business Profile authorization token | European Union |
| Resend | Transactional and account email | Authorized-user emails; reviewer names and review content in summaries | United States |
| SFTPCloud | Secure receipt of transaction files | Transaction records, including contact and purchase data | United States |
| Sentry (Functional Software, Inc.) | Application and scheduled-job monitoring and error tracking | Personal data incidentally present in error events | United States |
| Mapbox, Inc. | Store-locator address search (geocoding) and map display | ZIP codes, cities, or addresses that shoppers type into the store locator; shoppers’ IP addresses when their browsers load map tiles | United States |
| Termly Inc. | Cookie-consent management and privacy-request portal | Privacy-request data and consent records | United States |
AI features. AI features run through Vercel’s AI Gateway. The model providers it uses are subprocessors of Vercel.
Google Business Profile. Zernio connects to Google Business Profile on our behalf, so Google is a subprocessor of Zernio.
Customer-controlled messaging providers. Review-request messages are sent through the customer’s own messaging and telephony accounts (for example Klaviyo, Twilio, or Mailchimp). Those providers are engaged directly by the customer and are not our subprocessors.