Sub-Processors
Last updated: 2026-10-17
Ordinary engages the following third-party service providers (“Sub-Processors”) to process Personal Data on behalf of merchant customers who use the Ordinary Service. This list is maintained as required by Section 6 of Ordinary’s Data Processing Agreement.
Ordinary updates this list when it engages a new Sub-Processor, and notifies merchants in the Ordinary app and by email to organisation administrators. Merchants may object to a new Sub-Processor within 30 days of that notice, per Section 6.2 of the DPA.
This revision clarifies Resend’s newsletter contact-management role and Cloudflare Turnstile’s newsletter signup protection. Ordinary also uses Resend for its own voluntary newsletter subscribers; those contacts are distinct from merchant customer data processed under the DPA.
Core infrastructure
| Sub-Processor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel | Application hosting (Next.js) | All request/response data in transit; logs | USA (primary), global edge |
| Neon | Primary Postgres database (managed) | All application data at rest | USA (AWS us-east-1) |
| Backblaze (B2 Cloud Storage) | Independent database backups and historical recovery archives | Backup copies of merchant and customer data held by Ordinary | Europe |
| Digital Ocean App Platform | Background worker (Graphile) hosting for async tasks (webhook processing, backfills) | Queue payloads; temporarily holds event data in transit | USA (primary region) |
| DigitalOcean Spaces | File storage (admin-files, imported data, temporary export bundles) | Uploaded files, data export JSONs | USA |
| Cloudflare | Receives and stores session replay recordings, serves the replay player to authorised merchant users, and protects Ordinary newsletter signup from automated abuse | Session replay content (rendered storefront pages with typed input masked before transmission), visitor IP address in transit; browser and network signals for newsletter bot checks | USA / global edge |
Authentication and user management
| Sub-Processor | Purpose | Data processed | Location |
|---|---|---|---|
| Clerk | User authentication, session management, MFA | Authorised-user email, name, password (hashed, stored by Clerk), IP address, user agent, session tokens | USA |
Communications
| Sub-Processor | Purpose | Data processed | Location |
|---|---|---|---|
| Resend | Email delivery (newsletters, subscription confirmations, product updates, onboarding, GDPR data-request bundles, system notifications), newsletter contact management, and delivery, open and click measurement | Recipient email and subscription preferences; subject, body, attachments; delivery, open and click events | USA |
Source-system integrations (data ingestion)
| Sub-Processor | Purpose | Data processed | Location |
|---|---|---|---|
| Shopify | Source of merchant store data (orders, customers, products, webhooks) | OAuth token, store data synced per merchant authorisation | Global (Shopify’s own infrastructure) |
| Meta (Graph API) | Read-only pull of merchant’s own ad campaign performance data | OAuth token, campaign metadata, ad performance metrics (aggregate, no customer data) | USA |
| Google (Analytics Data API, Search Console API, Sheets API) | Read-only pull of merchant’s GA4 / GSC / Sheets data (optional per merchant) | OAuth token, aggregate session / search / spreadsheet data | USA |
| Amazon Ads API | Read-only pull of merchant’s Amazon ad campaign performance (optional per merchant) | OAuth token, campaign metadata, ad performance metrics | USA |
| Amazon Selling Partner API (SP-API) | Read-only pull of merchant’s own Amazon Seller account business data — sales & traffic, financials, inventory, orders (optional per merchant) | OAuth token, aggregate sales / traffic metrics, financial event amounts (settlements / fees / refunds), inventory levels, order records (product / quantity / price; no end-buyer personal data) | USA |
| PostHog | Legacy merchant analytics ingestion for orgs that installed PostHog before Ordinary’s pixel | OAuth token, aggregate session data | USA or EU per merchant’s PostHog region |
| Klaviyo | Read-only pull of merchant’s own email + SMS campaign and flow performance data (optional per merchant) | OAuth token, campaign / flow metadata, send metrics (recipients, opens, clicks, unsubscribes, bounces, attributed revenue) | USA |
Ad-platform forwarding (outbound, at merchant instruction)
These Sub-Processors receive hashed customer identifiers only, forwarded on the merchant’s explicit instruction via an OAuth-authorised connection to the merchant’s own ad account. Merchants can disconnect at any time via Settings → Integrations.
| Sub-Processor | Purpose | Data processed | Location |
|---|---|---|---|
| Meta Conversions API | Server-side purchase event forwarding to merchant’s own Meta ad account | SHA-256 hashed email / phone / first name / last name; purchase amount, currency, timestamp, event ID | USA |
| Google Enhanced Conversions (planned) | Server-side conversion forwarding to merchant’s own Google Ads account | SHA-256 hashed user data; purchase amount, currency, timestamp | USA |
Billing and subscriptions
| Sub-Processor | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe | Subscription billing for Ordinary’s own fees to merchants | Merchant billing contact, payment method (tokenised), subscription state | USA |
Ordinary’s own product analytics (internal)
| Sub-Processor | Purpose | Data processed | Location |
|---|---|---|---|
| PostHog (our instance) | Product analytics on Ordinary’s own application usage by authorised merchant users | Authorised-user events (page views, clicks within Ordinary), pseudonymous user ID | USA |
Note: this is Ordinary’s own product-analytics instance, separate from any merchant’s PostHog integration. It collects behaviour of merchant administrators inside the Ordinary dashboard, not their customers’ behaviour on their storefronts.
Data transfer mechanisms
For transfers of Personal Data from the EEA / UK / Switzerland to the US or other third countries:
- Where a Sub-Processor is certified under the EU-US Data Privacy Framework, we rely on that certification.
- Where it isn’t, we rely on the 2021 Standard Contractual Clauses (SCCs), Module 2 (Controller → Processor) or Module 3 (Processor → Sub-Processor) as applicable.
Merchants subject to EU/UK/Swiss data-protection law may request a signed copy of the SCCs via privacy@tryordinary.com.
Change log
| Date | Change |
|---|---|
| 2026-04-20 | Initial launch list published |
| 2026-08-04 | Listed Cloudflare as a core-infrastructure Sub-Processor. Cloudflare receives and stores Session Replay recordings and serves the replay player to authorised merchant users. Notice issued to merchants in-app and by email; merchants who wish to object under Section 6.2 of the DPA may do so at privacy@tryordinary.com. |
| 2026-06-09 | Listed the Amazon Selling Partner API (SP-API) as a distinct data-ingestion entry, alongside the existing Amazon Ads API. Same vendor (Amazon) and region (USA); read-only ingest of the merchant’s own Amazon Seller business data (sales & traffic, financials, inventory, orders) with no end-buyer personal data. |