Skip to content
Start your store

Legal

Sub-processors

The companies that process personal data for Demirius Ltd to run My-Pepts: what each one does, what it sees and where.

Last updated

Contents · 3 sections
  1. 1.Current sub-processors
  2. 2.Services you connect yourself
  3. 3.Changes to this list

We use a small number of providers to host, store, email, bill and provide AI features. Some process data about our own customers, for which we are the controller (see our Privacy Policy). Most also process the personal data in labs' stores, for which we are the lab's processor and they are our sub-processors under our Data Processing Agreement.

1.Current sub-processors#

Vercel (United States)
What it does
Hosting my-pepts.com and the account dashboard, and routing visitors to lab storefronts.
Personal data it sees
Everything sent to or from those sites while in transit, and request logs (IP address, browser, page, time).
Where the data is
Worldwide edge network; the servers that run the dashboard are in the United States
Whose data
Account data, Store data
Neon (United States)
What it does
The managed PostgreSQL database behind my-pepts.com.
Personal data it sees
Account, staff, billing and store records for each lab, and sign-in sessions.
Where the data is
United Kingdom (London)
Whose data
Account data
Hetzner (Germany)
What it does
The servers that run each lab's store, its own database and its backups.
Personal data it sees
Everything in a lab's store: products, orders, customers, messages and the store's logs.
Where the data is
Germany and Finland by default; the United States for a store hosted there
Whose data
Store data
Amazon Web Services (United States)
What it does
File storage for photos and documents attached in a store's admin.
Personal data it sees
Files staff upload in the admin, such as photos of parcels (which show the shipping label), supplier quotes and invoices.
Where the data is
The same region as the store's hosting: the European Union, or the United States
Whose data
Store data
Resend (United States)
What it does
Sending email: our account and billing emails, and the transactional and marketing email labs send from their stores.
Personal data it sees
Recipient name and email address, the content of each email, and delivery, bounce and open events.
Where the data is
European Union (Ireland) for stores' email; the United States for parts of the service
Whose data
Account data, Store data
Stripe (United States, with UK and Irish companies)
What it does
Billing labs for their My-Pepts subscription and services. Stripe does not process shoppers' payments to labs.
Personal data it sees
Billing name, email and address, card details (held by Stripe; we see only the brand, last four digits and expiry), invoices and payment status.
Where the data is
United Kingdom, European Union and United States
Whose data
Account data
Anthropic (United States)
What it does
AI features: drafting and suggesting content, summarising store data, and answering questions in the admin. Only when an AI feature is used.
Personal data it sees
Whatever a lab or its staff send to an AI feature, which can include store data such as a shopper's message, and what the feature returns.
Where the data is
United States
Whose data
Account data, Store data
Google (United States, with an Irish company for Europe)
What it does
The Google Ads integration: reading campaign results and reporting which orders came from an advert. Only when a lab connects its Google Ads account.
Personal data it sees
Campaign data, and for orders that followed a Google advert, the click identifier, order value and time. No shopper names, addresses or email addresses.
Where the data is
United States and other countries where Google operates
Whose data
Store data

In the last column, account data is data about our own customers and their staff, and store data is the personal data in labs' stores, mostly about their shoppers.

Each of them processes personal data under a data processing agreement with us that protects it at least as well as our own commitments, and only for the purpose listed.

2.Services you connect yourself#

Some services a lab uses with its store are contracted by the lab directly, not by us, so they are the lab's own providers rather than our sub-processors:

  • the payment provider that takes your shoppers' payments;
  • your couriers and shipping label services;
  • your Google Ads account itself, which is between you and Google (we appear above only for the data our integration handles);
  • any other app or service you connect with your own account and keys.

Your agreements with those providers govern what they do with the data.

3.Changes to this list#

We email every account owner at least 30 days before a new or replacement sub-processor starts processing store data, and update this page the same day. A lab can object, as the Data Processing Agreement explains.

If you are not an account owner and would like to hear about changes, email hello@my-pepts.com and we will add you to the notice list. Transfers outside the UK are protected as the Data Processing Agreement describes.

Company details

Company
Demirius Ltd, trading as My-Pepts
Registered in
England and Wales
Company number
16820023
Registered office
47 Cranwell Crescent, Eaton Leys, Milton Keynes, MK17 9GS, England
VAT number
GB 505 3821 14
Email
hello@my-pepts.com

Last updated