Providers and subprocessors
Providers are listed separately for the public website and each app. Only relevant providers receive the data required for the function you use. Connected platforms and downstream AI services have distinct roles; this list does not give every provider access to every app. Public vendor notices do not establish API-specific contracts or no-training commitments. Prisma is a software library, not a separate subprocessor.
Effective: October 26, 2026Last updated: October 26, 2026
Public website
Vercel
- Service
- Public website hosting
- Purpose
- Deliver pages and support endpoints; maintain security.
- Data processed
- Web requests, IP/device and limited technical records; support submissions in transit.
- Role and conditions
- Hosting provider; processor where acting on ShopiDeck instructions.
- Country or region
- United States; other locations under the applicable service configuration and terms.
Resend
- Service
- Support email
- Purpose
- Deliver requested support to team@shopideck.com.
- Data processed
- Name, email, store, selected app, subject, and message.
- Role and conditions
- Email provider for ShopiDeck support.
- Country or region
- International processing under the provider's applicable terms; no exclusive region established here.
Tally
- Service
- External early-access forms
- Purpose
- Collect voluntary early-access requests on the Less Time Marketing landing page.
- Data processed
- Submitted form fields and technical data when the widget loads or form opens.
- Role and conditions
- Form provider; its privacy notice also governs its own operations.
- Country or region
- Provider infrastructure and subprocessors under Tally's terms; no app database access.
SD: Klaviyo Bot Cleaner
Shopify
- Service
- App platform and billing
- Purpose
- Install, authenticate, bill, and deliver compliance events for Bot Cleaner.
- Data processed
- Store/admin identity, sessions, plan, usage and privacy-request identifiers.
- Role and conditions
- Independent platform; contractual role depends on the operation.
- Country or region
- Countries where Shopify processes; international transfers may occur.
Klaviyo
- Service
- Authorized profile API
- Purpose
- Account/profile queries, subscription data, and merchant-confirmed suppression.
- Data processed
- Authorized account/profile data, encrypted OAuth credentials, and confirmed suppression requests.
- Role and conditions
- Merchant-connected independent platform; account terms govern its processing.
- Country or region
- Countries where Klaviyo processes; international transfers may occur.
Supabase
- Service
- PostgreSQL and app storage
- Purpose
- Store Bot Cleaner records, audit results, suppression history, and privacy requests.
- Data processed
- Bot Cleaner account/profile records and derived data as described in its addendum.
- Role and conditions
- Database/storage subprocessor for instructed app processing.
- Country or region
- US East, United States.
Vercel
- Service
- App hosting
- Purpose
- Run Bot Cleaner server functions.
- Data processed
- Requests and data handled by Bot Cleaner functions, limited logs.
- Role and conditions
- Hosting subprocessor for instructed processing.
- Country or region
- United States.
Resend
- Service
- Service email
- Purpose
- Send relevant Bot Cleaner support/service messages.
- Data processed
- Recipient and necessary message content; not entire profile datasets.
- Role and conditions
- Email provider; subprocessor where handling instructed data.
- Country or region
- Region not established in current documentation; international processing may occur.
SD: Less Time Marketing
Shopify
- Service
- Store, products, Files, and billing
- Purpose
- Installation, authentication, product retrieval, final asset storage, and charges.
- Data processed
- Store identity, catalog, generated media and billing state; no Shopify customers, orders, or payment datasets.
- Role and conditions
- Independent platform; role depends on the operation and applicable agreement.
- Country or region
- Canada, United States, and other locations under Shopify's terms.
Vercel
- Service
- App hosting
- Purpose
- Run content-generation, scheduling, and publishing functions.
- Data processed
- App traffic, necessary input/output processing, and limited technical records.
- Role and conditions
- Hosting subprocessor for instructed app processing.
- Country or region
- United States; applicable configuration and provider terms govern other processing.
Neon
- Service
- PostgreSQL database
- Purpose
- Store app records, campaigns, credits, and encrypted connected-account tokens.
- Data processed
- App metadata and records in its privacy addendum; not a permanent product-media library.
- Role and conditions
- Database subprocessor for instructed app processing.
- Country or region
- Specific project region pending verification in Neon deployment settings. No exclusive country or data-residency guarantee is asserted.
fal.ai
- Service
- AI generation and media orchestration
- Purpose
- All AI requests pass through fal.ai: text, creative ideas/selection, image/video, music, subtitles, and media assembly.
- Data processed
- Relevant product/brand inputs, prompts, product images, generated media and job metadata. Connected-platform OAuth tokens are not generation inputs.
- Role and conditions
- Generation provider/subprocessor; downstream services listed separately below. Contractual confirmation of external-provider training restrictions is pending.
- Country or region
- United States and downstream-provider processing locations under the selected service/model contracts; not confined to fal.ai's headquarters.
Resend
- Service
- Service email
- Purpose
- Review/reconnection notices, trial notices, and optional summaries.
- Data processed
- Store contact email and necessary notice content.
- Role and conditions
- Email provider; subprocessor where handling instructed data.
- Country or region
- International processing under applicable provider terms; exact service region not established here.
OpenRouter
- Service
- Downstream generation/routing via fal.ai
- Purpose
- Text-model routing through fal.ai's openrouter/router service.
- Data processed
- Only inputs, prompts, media, outputs, and metadata needed for the selected generation/routing operation; not all inputs are sent to every provider.
- Role and conditions
- Downstream provider in the generation chain. Exact entity, routing, retention, DPA, transfer, and no-training conditions are pending contractual verification. A general public privacy notice is not proof of an API no-training commitment.
- Country or region
- Depends on the actual model deployment, routing, and contract; countries and transfer safeguards must be verified. No processing country is inferred from the brand name.
Anthropic
- Service
- Downstream generation/routing via fal.ai
- Purpose
- Text generation, creative ideas, and creative selection.
- Data processed
- Only inputs, prompts, media, outputs, and metadata needed for the selected generation/routing operation; not all inputs are sent to every provider.
- Role and conditions
- Downstream provider in the generation chain. Exact entity, routing, retention, DPA, transfer, and no-training conditions are pending contractual verification. A general public privacy notice is not proof of an API no-training commitment.
- Country or region
- Depends on the actual model deployment, routing, and contract; countries and transfer safeguards must be verified. No processing country is inferred from the brand name.
OpenAI
- Service
- Downstream generation/routing via fal.ai
- Purpose
- Fallback text and maximum-quality image generation.
- Data processed
- Only inputs, prompts, media, outputs, and metadata needed for the selected generation/routing operation; not all inputs are sent to every provider.
- Role and conditions
- Downstream provider in the generation chain. Exact entity, routing, retention, DPA, transfer, and no-training conditions are pending contractual verification. A general public privacy notice is not proof of an API no-training commitment.
- Country or region
- Depends on the actual model deployment, routing, and contract; countries and transfer safeguards must be verified. No processing country is inferred from the brand name.
- Service
- Downstream generation/routing via fal.ai
- Purpose
- Standard image editing and maximum-quality short-video generation.
- Data processed
- Only inputs, prompts, media, outputs, and metadata needed for the selected generation/routing operation; not all inputs are sent to every provider.
- Role and conditions
- Downstream provider in the generation chain. Exact entity, routing, retention, DPA, transfer, and no-training conditions are pending contractual verification. A general public privacy notice is not proof of an API no-training commitment.
- Country or region
- Depends on the actual model deployment, routing, and contract; countries and transfer safeguards must be verified. No processing country is inferred from the brand name.
MiniMax
- Service
- Downstream generation/routing via fal.ai
- Purpose
- Standard short-video generation.
- Data processed
- Only inputs, prompts, media, outputs, and metadata needed for the selected generation/routing operation; not all inputs are sent to every provider.
- Role and conditions
- Downstream provider in the generation chain. Exact entity, routing, retention, DPA, transfer, and no-training conditions are pending contractual verification. A general public privacy notice is not proof of an API no-training commitment.
- Country or region
- Depends on the actual model deployment, routing, and contract; countries and transfer safeguards must be verified. No processing country is inferred from the brand name.
ByteDance
- Service
- Downstream generation/routing via fal.ai
- Purpose
- Seedance video generation, including longer and creative videos and legacy reserved jobs.
- Data processed
- Only inputs, prompts, media, outputs, and metadata needed for the selected generation/routing operation; not all inputs are sent to every provider.
- Role and conditions
- Downstream provider in the generation chain. Exact entity, routing, retention, DPA, transfer, and no-training conditions are pending contractual verification. A general public privacy notice is not proof of an API no-training commitment.
- Country or region
- Depends on the actual model deployment, routing, and contract; countries and transfer safeguards must be verified. No processing country is inferred from the brand name.
Kuaishou / Kling
- Service
- Downstream generation/routing via fal.ai
- Purpose
- Video-to-audio background music generation.
- Data processed
- Only inputs, prompts, media, outputs, and metadata needed for the selected generation/routing operation; not all inputs are sent to every provider.
- Role and conditions
- Downstream provider in the generation chain. Exact entity, routing, retention, DPA, transfer, and no-training conditions are pending contractual verification. A general public privacy notice is not proof of an API no-training commitment.
- Country or region
- Depends on the actual model deployment, routing, and contract; countries and transfer safeguards must be verified. No processing country is inferred from the brand name.
Wan / Alibaba
- Service
- Downstream generation/routing via fal.ai
- Purpose
- Legacy reserved Wan video jobs only; not a general new-job authorization.
- Data processed
- Only inputs, prompts, media, outputs, and metadata needed for the selected generation/routing operation; not all inputs are sent to every provider.
- Role and conditions
- Downstream provider in the generation chain. Exact entity, routing, retention, DPA, transfer, and no-training conditions are pending contractual verification. A general public privacy notice is not proof of an API no-training commitment.
- Country or region
- Depends on the actual model deployment, routing, and contract; countries and transfer safeguards must be verified. No processing country is inferred from the brand name.
Meta (Facebook / Instagram)
- Service
- Optional connected publishing platform
- Purpose
- Publish authorized content to the account you select, only if connected.
- Data processed
- Account/channel identity and approved copy, hashtags, image/video, and publishing options as applicable. The platform issues its own authorization tokens.
- Role and conditions
- Merchant-selected recipient and independent controller for its platform operations, not automatically a ShopiDeck subprocessor for all activities. Google/YouTube publishing is distinct from Google's AI-generation role above.
- Country or region
- Platform processing locations under its own terms; international processing may occur.
TikTok
- Service
- Optional connected publishing platform
- Purpose
- Publish authorized content to the account you select, only if connected.
- Data processed
- Account/channel identity and approved copy, hashtags, image/video, and publishing options as applicable. The platform issues its own authorization tokens.
- Role and conditions
- Merchant-selected recipient and independent controller for its platform operations, not automatically a ShopiDeck subprocessor for all activities. Google/YouTube publishing is distinct from Google's AI-generation role above.
- Country or region
- Platform processing locations under its own terms; international processing may occur.
Google / YouTube
- Service
- Optional connected publishing platform
- Purpose
- Publish authorized content to the account you select, only if connected.
- Data processed
- Account/channel identity and approved copy, hashtags, image/video, and publishing options as applicable. The platform issues its own authorization tokens.
- Role and conditions
- Merchant-selected recipient and independent controller for its platform operations, not automatically a ShopiDeck subprocessor for all activities. Google/YouTube publishing is distinct from Google's AI-generation role above.
- Country or region
- Platform processing locations under its own terms; international processing may occur.
- Service
- Optional connected publishing platform
- Purpose
- Publish authorized content to the account you select, only if connected.
- Data processed
- Account/channel identity and approved copy, hashtags, image/video, and publishing options as applicable. The platform issues its own authorization tokens.
- Role and conditions
- Merchant-selected recipient and independent controller for its platform operations, not automatically a ShopiDeck subprocessor for all activities. Google/YouTube publishing is distinct from Google's AI-generation role above.
- Country or region
- Platform processing locations under its own terms; international processing may occur.