Sub-processors
Last Updated: September 4, 2026
Buy Box Checker uses the third-party providers below to deliver the Service. This page is referenced by Section 14 of our Terms of Service and supplements our Privacy Policy.
We will email the privacy contact for each customer whose use is governed by our DPA at least 30 days before a new or replacement Subprocessor begins processing Customer Personal Data. The notice will identify the provider and its role. During that period, the customer may object on reasonable data-protection grounds by emailing help@buyboxchecker.com. Section 8.3 of the DPA describes the objection process and available remedies. For other data-processing questions, contact help@buyboxchecker.com.
Separately from the providers below, some pages load content directly from third parties, which means those parties see your IP address and request metadata: Amazon's image CDN for product images, jsDelivr for map data on our public Buy Box check, and YouTube where a video is embedded.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database and user authentication | Account data, monitoring configuration, monitoring history | United States |
| Vercel | Application hosting and content delivery | Request metadata, IP addresses | United States |
| Stripe | Payment processing and subscription billing | Billing name, email, address, transaction history. Card details go directly to Stripe and never reach our servers. | United States |
| Amazon data collection provider | Collection of public Amazon product page data | ASINs and monitoring locations submitted to the collector, and public Amazon product-page data returned for those requests. Returned data may include seller names or identifiers that constitute personal data in context. | European Union |
| Resend | Transactional and daily digest email delivery | Email address, message content | United States |
| Inngest | Background job orchestration for checks and digests | Job payloads referencing account and ASIN identifiers | United States |
| PostHog | Product analytics, and session replay inside the signed-in dashboard | Usage events, name and email address for identified users, device and browser metadata, and recorded dashboard sessions | United States |
| Google (Analytics and Tag Manager) | Website traffic analytics | Pseudonymous usage events, device and browser metadata | United States |
| Google (Gemini API) | AI-generated summaries of your account data | Your monitoring data at the time of generation: your seller name, the ASINs you track, per-location Buy Box status including city or postcode, and competing seller names and prices | United States |
| Cloudflare | DNS and bot protection on public forms (Turnstile) | IP address, request metadata | United States |
| Chatwoot (self-hosted by us) | Customer support chat and email. The chat widget loads on all pages. | Name, email address, conversation content; for signed-in users also your plan and account identifier, so support can find your account | United States (Oregon) |
| Hetzner | Server hosting for the self-hosted Chatwoot instance above | Whatever Chatwoot stores, at rest on their infrastructure | United States (Oregon) |
| FirstPromoter | Referral and affiliate attribution | Referral codes, conversion events, and for enrolled affiliates, name, email address and account identifier | European Union |