Subprocessors
Effective and last updated: 3 November 2026
| Subprocessor | What it does for Termpact | Data processed | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Servers and database (Amazon Lightsail); email sending and receiving (Amazon SES); storage of inbound email (Amazon S3) | All merchant data; email addresses and email content | Australia (Asia Pacific – Sydney) |
| Backblaze, Inc. | File storage (exports, documents) and encrypted database backups | All merchant data (encrypted backups), uploaded files | United States (US East) |
| Anthropic, PBC | Reading purchase orders sent to the order inbox (only when the merchant uses it) | Document content, which may include names and addresses | United States |
| Voyage AI, Inc. | Search embeddings for matching order lines to products | Product catalog text only (no personal data) | United States |
| Functional Software, Inc. (Sentry) | Error reports | Scrubbed technical data; request identifiers | United States |
| Grafana Labs | Metrics, logs and traces | Scrubbed technical data; request identifiers | United States |
| Cloudflare, Inc. | DNS, network protection, help-site hosting, forwarding of our own mail addresses | Technical data (IP addresses) | Global network |
Not subprocessors: GitHub (source code and CI; never receives merchant data). Systems a merchant connects through the Termpact API or webhooks receive data on the merchant’s instruction under the merchant’s own agreement with them.
Termpact is operated by Saim Tech from Pakistan; our own personnel access merchant data there only to run and support the service.
Changes
Section titled “Changes”We notify merchants in the app at least 30 days before a new subprocessor starts processing their data. A merchant may object during that period; if we can’t address the objection, the merchant may stop using Termpact and receive a pro-rata refund of prepaid fees.
Questions: [email protected].