Subprocessors

The services WeaveCycle uses to run the product.

Every service provider that handles data for WeaveCycle, listed for GDPR transparency. It is a legal-review draft dated September 22, 2026.

Service provider

Vercel

Purpose

Web application hosting, preview deployments, CDN, route execution, and cookieless web analytics.

Data categories

Public site traffic, web app requests, deployment logs, aggregate pageview counts after analytics consent, and limited account or session metadata.

Region posture

Frankfurt preferred for route execution where applicable; CDN/static delivery may be globally distributed.

Transfer safeguard

Provider DPA and Standard Contractual Clauses where non-EEA processing occurs.

Service provider

Render

Purpose

FastAPI service and worker hosting.

Data categories

Authenticated API requests, operational logs, Shopify sync events, and workspace workflow processing.

Region posture

Frankfurt production target.

Transfer safeguard

EU regional deployment plus provider contractual safeguards.

Service provider

Supabase

Purpose

Postgres database, authentication, and session management.

Data categories

User profiles, organizations, memberships, workspace records, auth identifiers, and application data.

Region posture

EU: the production project runs in Ireland (eu-west-1).

Transfer safeguard

EU region selection plus provider DPA and transfer safeguards where applicable.

Service provider

PostHog

Purpose

Public analytics after consent and signed-in product analytics.

Data categories

Pageview and product usage events, browser metadata, timestamps, and event properties.

Region posture

EU host target: https://eu.i.posthog.com.

Transfer safeguard

Consent for public analytics, EU host configuration, and provider contractual safeguards.

Service provider

OpenRouter

Purpose

Routes AI requests for photo inspection and return-reason categorization to the underlying model provider.

Data categories

The shopper's return photo, the catalog photo of the ordered item, product details, and the return reason. Shopper names and email addresses are never sent.

Region posture

US-based provider; the model provider it routes to may process elsewhere.

Transfer safeguard

Data minimized before sending; provider terms and Standard Contractual Clauses where non-EEA processing occurs.

Service provider

Resend

Purpose

Sending transactional email: return updates to shoppers, and account and workspace emails to merchants.

Data categories

Recipient email addresses, email content, and delivery status.

Region posture

US-based provider.

Transfer safeguard

Provider DPA and Standard Contractual Clauses where non-EEA processing occurs.

Service provider

Shopify

Purpose

Merchant store OAuth, product/order/customer-related data source, and webhook delivery.

Data categories

Store domain, OAuth scopes, product records, order records, customer-related order data, and webhook metadata.

Region posture

Region depends on Shopify merchant account, Shopify infrastructure, and merchant configuration.

Transfer safeguard

Merchant authorization through Shopify OAuth and Shopify platform contractual terms.

Change handling

Early list, explicit updates.

WeaveCycle will update this page when material subprocessors are added or when the production region posture changes. A formal contractual subprocessor notice period should be added during legal review.

Merchants with a DPA, procurement, or data-residency requirement should contact hello@weavecycle.aibefore sending live production data.