Subprocessors
Every company that processes personal data for Overvio, what it does, which data it sees, where, and the safeguard when it is based outside the EU. We tell account owners 15 days before we add or replace a subprocessor.
Last updated
Read the Data Processing AgreementSubprocessors for merchants' data
These companies process the personal data Overvio processes for a merchant: the merchant's contacts and shoppers. Overvio is the merchant's processor for that data, so they are subprocessors, and this list is Annex III of the Data Processing Agreement. Version: 29 October 2026, in force from that day.
| Company | What it does for Overvio | Personal data | Where the data is processed | Company's home and safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Servers: the dashboard application, its main database and cache, the event store, the storefront event service and the search service with their stores; whole-server backups kept 7 days | Every category the Data Processing Agreement lists that lives in those databases and on those disks: consent records, suppressions, send records, storefront and email events, orders, the links between a shopper's identifiers | EU | Germany. No transfer: processing stays in the EU |
| DigitalOcean, LLC | The managed MongoDB database of the dashboard and of the storefront event service | Contacts (email address, name and the other fields the merchant imports), lists and audiences, sign-up answers, send events with the opener's IP address and browser, cart snapshots, storefront browsing records | EU | United States. EU-US Data Privacy Framework, with the standard contractual clauses as fallback, in its data processing terms |
| Amazon Web Services EMEA SARL | Sends the merchant's email (SES); carries delivery, bounce and complaint events back to Overvio (SNS, SQS); stores email images (S3) and serves them through CloudFront at assets.overvio.com; stores DMARC reports | The recipient's email address and the message (SES); delivery, bounce and complaint events naming the recipient; the IP address and browser of a recipient whose mail app loads an image (CloudFront). DMARC reports name no person | EU region. CloudFront answers from AWS's edge locations, which can be outside the EU | Luxembourg, part of a US group. AWS's data processing addendum, with the standard contractual clauses |
| Cloudflare, Inc. | Stores Overvio's encrypted database backups (kept 30 days); DNS; serves the storefront scripts from cdn.overvio.com and protects the search service at ml.overvio.com; stores published popup designs once popups are on | Backups: every category in them, but only encrypted on our servers before upload, with no key at Cloudflare. Scripts and search: the IP address of a shopper whose browser loads them, and search traffic | Backups: EU. Scripts and search: Cloudflare's global network | United States. EU-US Data Privacy Framework, with the standard contractual clauses as fallback, in its data processing terms |
| Functional Software, Inc. (Sentry) | Receives reports of application errors from the dashboard and the storefront event service | An error report can carry an account id and identifiers that appear in an error message. Request bodies, headers and cookies are removed before a report is sent | Sentry's cloud, which can be in the United States | United States. EU-US Data Privacy Framework, with the standard contractual clauses as fallback, in its data processing terms |
| Bouncer Sp. z o.o. | Checks whether an email address can receive mail, when address verification runs | The email address only | EU | Poland. No transfer: processing stays in the EU |
| Voyage AI Innovations, Inc. | Turns product text into the vectors product search uses, through Overvio's search service | None while search is off, as it is at launch: it receives product catalogue text only. Once search is on, a shopper's search words, which can hold personal data | United States | United States. No personal data is sent while search is off |
Providers for Overvio's own data
These companies process data Overvio controls itself: its account users, billing contacts and website visitors. The Privacy Policy explains that data.
| Company | What it does for Overvio | Personal data | Where the data is processed | Company's home and safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosts the dashboard, and this website with the messages sent through its contact form | Account users' activity logs and sessions, the staff and access audit records, billing records; a contact form sender's name, email, store address and message (kept 24 months), and the IP address checked by the spam limit | EU | Germany. No transfer |
| DigitalOcean, LLC | Hosts the dashboard's account records | Account user name, email, password hash, Google account id | EU | United States. EU-US Data Privacy Framework, with the standard contractual clauses as fallback, in its data processing terms |
| Amazon Web Services EMEA SARL | Sends Overvio's own mail to account users (password resets, invoices, plan and sending notices), and the contact form's notification to Overvio | Account user email and the message; the contact form message | EU region | Luxembourg, part of a US group. AWS's data processing addendum, with the standard contractual clauses |
| Stripe Payments Europe, Ltd. | Card payments for paid plans, on Stripe's own checkout and customer portal; no card data reaches Overvio | Billing email, Stripe customer id, payment and subscription details | EU, with onward transfer to Stripe, Inc. in the United States | Ireland. Onward: the EU-US Data Privacy Framework and the standard contractual clauses (Stripe, Inc.) |
| Elorus P.C. | Issues each Greek invoice and credit note and sends it to the tax authority's myDATA system, as Greek law requires | Buyer's legal name, ΑΦΜ, ΔΟΥ, business address, invoice lines and amounts. No email, no card data | Greece | Greece. No transfer. myDATA receives each invoice by law |
| Cloudflare, Inc. | Delivers and protects overvio.com; the Turnstile spam check on the contact form; forwards mail sent to privacy@overvio.com; backups as in the first list | A visitor's IP address and request data; the Turnstile check's browser signals; the sender, subject and body of a message to the privacy address while it is forwarded | Cloudflare's global network | United States. EU-US Data Privacy Framework, with the standard contractual clauses as fallback, in its data processing terms |
| Google Ireland Limited | Google Analytics 4 on overvio.com, only after a visitor accepts it. For Sign in with Google and Gmail Postmaster Tools, Google acts as a controller of its own | Analytics: pages viewed, device and browser, approximate location, the random id in the _ga cookies. Sign in with Google: the Google account email, name and id of a user who chooses it. Postmaster: per sending domain, no person | Google's global infrastructure | Ireland, with Google LLC (United States) processing with it. The EU-US Data Privacy Framework and the standard contractual clauses |
| Functional Software, Inc. (Sentry) | Error reports, as in the first list | An error report can carry an account user's id | Sentry's cloud, which can be in the United States | United States. EU-US Data Privacy Framework, with the standard contractual clauses as fallback, in its data processing terms |
| Slack Technologies Limited | Carries Overvio's operator alerts to its own team | An alert can name a merchant's business and its domain; never shopper data | United States | Ireland, part of a US group. The EU-US Data Privacy Framework or the standard contractual clauses, in its data processing terms |
| Cal.com, Inc. | The booking calendar on the demo page, only after a visitor chooses to load it | The name, email and chosen time of a person who books, and what Cal.com stores in the browser | United States | United States. The EU-US Data Privacy Framework and the standard contractual clauses |
| Canva Pty Ltd | A merchant's Canva connection for importing designs, once it is on (off at launch) | The Canva user id and team id only, never a name or an email | Canva's infrastructure, including the United States and Australia | Australia. The standard contractual clauses |
Checked, and not subprocessors
| Service | Why it is not listed above |
|---|---|
| WooCommerce and Shopify | The merchant's own platform, which the merchant connects. Overvio receives data from it on the merchant's instruction; it processes nothing for Overvio |
| MySQL, ClickHouse, Valkey, Typesense, PostgreSQL | Software Overvio runs on its own servers. The hosting company is what is listed |
| Healthchecks.io | Receives a heartbeat from backup and alert jobs, with no personal data |
| GitLab | Holds Overvio's source code and runs its tests on test data; production data is not copied to it. It also receives operator alerts that name an account by its id only |
| Gmail Postmaster Tools API | Returns statistics per sending domain, with no personal data |
| DNS block lists such as Spamhaus | Lookups of domains and IP addresses, with no personal data |
How we tell you about a change
- At least 15 days before Overvio adds or replaces a subprocessor in the first list, it emails every account owner.
- A merchant may object on reasonable data protection grounds within 10 days of the notice, in writing to privacy@overvio.com. If we cannot find a solution together, the merchant may end the affected service or the agreement with no fee (Data Processing Agreement, section 7).
- This page shows the list as it stands, with its version date.