Subprocessors
Last updated: Effective: [EFFECTIVE DATE]
Playbuy uses the service providers below to run the app. Each one is bound by written data protection terms that protect personal data at least as well as our Data Processing Addendum. We give merchants at least 30 days' notice, by email and on this page, before a new subprocessor starts processing personal data.
Current subprocessors
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Railway | Hosting for the dashboard, API, background jobs and event collection; managed PostgreSQL database and Redis queue | All data the App stores: shop and staff account data, synced product data, video metadata, encrypted access tokens, storefront events and attribution records | United States (US East) |
| Cloudflare | Video storage, encoding and streaming (Cloudflare Stream); storage and delivery of widget files and published widget settings (R2 and CDN); DNS | Videos and poster images; published widget settings including product titles, prices and images; technical request data such as IP address and browser details when files are delivered | United States, with global edge delivery |
| Resend | Sending transactional email (sign-in links, team invitations, usage alerts) | Recipient email address, recipient name where known, and the email content | United States |
| Shopify | App platform: installation, authentication, webhooks, the web pixel runtime and app billing | Shop details, staff identity during sign-in, subscription and billing status | Canada, United States and other Shopify locations |
Planned subprocessors
We expect to start using these providers. They do not process any data today. We will give notice as described above before they do.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Sentry | Application error monitoring | Technical error reports (stack traces, request paths); configured to scrub personal data | United States |
Platforms you choose to connect
These platforms are not our subprocessors. You have your own account and agreement with each one, and we connect to it through its official API only if you choose to. Their own privacy policies apply.
| Platform | Purpose | Data involved | Status |
|---|---|---|---|
| Meta Platforms Instagram (Instagram API with Instagram Login) | Importing videos from an Instagram professional account the merchant connects | We receive an access token, the account's user ID and username, and the media the merchant selects. We send only the merchant's authorization. | Available |
| TikTok TikTok Login Kit and Display API | Connecting a TikTok account and listing its videos for import | We would receive an access token, the account's open ID and display name, and video metadata (title, description, cover image, duration). | Planned; video import not yet available |
Getting updates
We email changes to every installed store's contact address. To have another address added, email [CONTACT EMAIL] with the subject "Subprocessor updates".