Sub-processors
Last updated: 21 October 2026
These are the providers that process personal data for Friendzy on a store's behalf, under our Data Processing Agreement. Each one is bound by a contract that protects the data at least as well as the agreement does.
Each store is served either from the European Union or from the United States. That is decided once, when the store installs Friendzy, by the store's country, never by where a shopper is.
| Provider | What it does for Friendzy | Data it processes | Where |
|---|---|---|---|
| Google Cloud | Servers and database for the app, and the realtime server for stores served from the EU; operations logs. | Shopper accounts, the store's advisers, creators and staff, the live sessions of EU stores, and logs. | Germany (Frankfurt), logs included. |
| Amazon Web Services | Database for chat messages and saved product lists, storage for voice messages and backups, a job queue, and email sending. | Chat messages, saved lists, voice messages, backups of all stores, and the emails we send. | United States (Ohio) and Germany (Frankfurt); email from Sweden (Stockholm). Chat messages and saved lists of every store, EU stores included, are copied to both Ohio and Frankfurt. Voice messages are kept in the store's own region. |
| Oracle Cloud Infrastructure | The realtime server for stores served from the US. | The live sessions of US stores: who is in them, the pages and cart shown, rewards. | United States (Virginia). |
| MongoDB Atlas | Usage counts, purchase attribution, campaign arrival data, and debug logs while we troubleshoot a store. | Order totals and session ids (no names, emails or addresses), campaign fields, and storefront console output. | United States (Northern Virginia). |
| Cloudflare | DNS and the network in front of the app and the EU realtime server, and the relay for creator-room stage audio and video. | Traffic in transit, which it decrypts at its edge for the EU servers, and the audio and video of whoever is on a creator room's stage. Stage media passes through Cloudflare rather than directly between participants. It is not stored. | Cloudflare's global network. |
| Anthropic | The AI assistant that answers shoppers when no adviser is on duty (Growth plan). | The store's name, the shopper's display name and their latest messages in that conversation. | United States. |
| Sentry | Crash reports from the widget, the app and our servers. | What failed and where; the browser library also sends the visitor's IP address with each report. | European Union (Germany). |
Where data leaves the European Economic Area, as it does for the providers in the United States, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, or otherwise on the European Commission's standard contractual clauses.
Not sub-processors
These see some of the same data, but not as our processors:
- Shopify, the platform the store runs on, under its own terms with the store.
- The store's own tools, such as its Shopify Flow or a webhook address it chooses.
- Google, Facebook and Shop, when a shopper chooses one of them to sign in to their own Friendzy account.
- Public STUN servers, which a shopper's browser contacts directly to connect a call.
Changes to this list
Before we add or replace a sub-processor, we tell every store at least 30 days ahead: by email to the address on the store's account, and here, where the change is listed with the date it takes effect.
A store may object within those 30 days on reasonable data-protection grounds, by writing to us through the contact form. We then talk it over in good faith; if we cannot resolve it, the store may stop using the feature concerned or uninstall Friendzy (clause 7.3 of the agreement).
No changes since the list was first published on 21 October 2026.
SWARMSOFT S.R.L.CUI: 35103599
Trade Register No.: J12/3072/08.10.2015
Str. Cireșilor, Nr. 84, Cluj-Napoca, Cluj, Romania, European Union
End of document