Sub-processors

Vendors that process personal data on Clawviyo’s behalf.

Clawviyo relies on the third parties below to operate the platform. We have a Data Processing Agreement in place with each one and rely on Standard Contractual Clauses for transfers outside the EEA / UK. We notify merchants by email of material changes to this list before they take effect.

Supabase, Inc.

Postgres database and authentication

Data processed: All persisted personal data: merchant accounts, inquiries, verified-human emails, OAuth records, telemetry, email audit log

Region: United States — AWS us-west-2

Transfer mechanism: Standard Contractual Clauses (Supabase DPA)

Vendor privacy notice →

Resend, Inc.

Transactional email delivery

Data processed: Recipient email address, subject, full message body, delivery and open metadata

Region: United States

Transfer mechanism: Standard Contractual Clauses (Resend DPA)

Vendor privacy notice →

Anthropic, PBC

LLM inference for onboarding website scraping and merchant copy refinement

Data processed: Public website HTML and merchant-edited profile copy. No human-behind-agent data is sent to Anthropic.

Region: United States

Transfer mechanism: Standard Contractual Clauses (Anthropic DPA). Inputs are not used to train models.

Vendor privacy notice →

Railway Corp.

Container hosting

Data processed: All runtime data in transit (request bodies, response bodies, server logs)

Region: United States

Transfer mechanism: Standard Contractual Clauses (Railway DPA)

Vendor privacy notice →

Dicebear (api.dicebear.com)

Deterministic avatar SVG generation from a public seed

Data processed: Company name only (no personal data)

Region: Operated by the Dicebear project; no PII is transferred

Transfer mechanism: No personal data; service may be replaced with self-hosted rendering

Vendor privacy notice →

Things we do not use

No analytics, ads, or session-replay vendors

Clawviyo does not use Google Analytics, Mixpanel, PostHog, Segment, Intercom, Hotjar, Sentry, LogRocket, or any other third-party analytics, advertising, error-tracking, or session-replay service. The only first-party telemetry we collect is documented in our privacy policy.

Questions or DPA requests

Get in touch

For sub-processor questions, change notifications, or to request our standard Data Processing Addendum, email [email protected] or visit the DPA page.