Subprocessors

Last updated: September 23, 2026

These providers process data for enabled BulkiApps features under the DPA. Entries identify their functions, data, countries and transfer safeguards. Vendors used solely for Company's own controller activities are addressed in the Privacy Policy.

Current subprocessors

Subprocessor	Service / purpose	Data categories	Processing and remote-access countries	Transfer safeguard if applicable	Receives Shopify Merchant Data?
Microsoft Azure - Microsoft Corporation	Hosting, PostgreSQL database/backups, queueing, operational diagnostics and secret storage for the app	Merchant account/configuration and feature data, authorized Shopify data, encrypted submissions/subscriptions, request/security information and job payloads	United States (Azure Central US region). Microsoft may process or access data in other countries, for example for support, under its Data Protection Addendum.	Microsoft Products and Services Data Protection Addendum, which includes the EU Standard Contractual Clauses for transfers that need them	Yes, to the extent needed for enabled functions
Microsoft Azure - same contracting entity as above	Blob Storage for Form Builder and Product Options uploads and Product Reviews media/imports; Communication Services Email for requested notifications and Merchant routing; storage malware-scanning service where configured	Uploaded files and metadata, email recipient and message content, delivery information and relevant feature records	United States: Blob Storage in the Azure Central US region and a United States data location for Communication Services. Email may transit or be processed in other countries during delivery; support access is as described above.	Same applicable Microsoft arrangements, verified for the services and transfers used	Yes, including directly submitted Shopper data

Browser push services: when a Shopper subscribes to web push, the Shopper's browser chooses the service that delivers notifications (for example, Google for Chrome, Mozilla for Firefox, Apple for Safari and Microsoft for Edge). Company does not choose these services and has no contract with them, so they are not Company subprocessors. Each notification is encrypted under the Web Push standard so the service cannot read its content; the service receives the push endpoint, the encrypted payload and delivery metadata under the browser vendor's own terms and privacy policy.

Merchant-selected connections: enabled Klaviyo/Omnisend connections receive authorized profile, consent and feature data under Merchant's own account and terms with that provider. Shopify receives necessary integration, cart, publication and billing data under its own relationship with Merchant. Company remains responsible for what it sends to them. WhatsApp is not a subprocessor: the chat button only links to it. No AI integration is used.

Company's own analytics: the app sends PostHog, Inc. usage events about merchant staff, such as pages viewed, clicks and feature use, for Company's own product analytics. These events contain no Shopper data and no screen recordings, so PostHog does not process data on Merchant's behalf and is not a subprocessor; the Privacy Policy describes it.

Vendor restrictions

Before a subprocessor receives covered data, Company binds it to written purpose, security, confidentiality, secondary-use and onward-transfer restrictions that meet the DPA, applicable law and Shopify's requirements.

Changes to subprocessors

Company gives at least 30 days' advance notice of additions or replacements by email to Merchant's store contact address. Merchants may reasonably object on data-protection grounds. DPA Section 13 governs resolution, processing restrictions and termination/refunds. Updating this page does not replace notice. Contact support@bulkiapps.com for notices or objections.

Contact

Subprocessor or privacy questions: support@bulkiapps.com