Template — review with counsel before publishing. These documents are a starting point that covers common SaaS / commerce requirements (Stripe Connect platform, GDPR/CCPA basics). Have a lawyer tailor them to your entity, jurisdiction, and product before going live.

Subprocessors

Companies Preview Coffee Co. engages to process Personal Data on behalf of merchants. Pursuant to our Data Processing Agreement we publish this list and notify Controllers of changes at least 30 days in advance.

Active subprocessors

NameEntityRegionPurpose
StripeStripe, Inc.USPayment processing for storefront orders + Connect onboarding for merchants.
ResendResendUSTransactional email delivery (receipts, password resets, order updates).
CloudflareCloudflare, Inc.Global edgeCDN, edge compute, DDoS protection.
VercelVercel, Inc.US / globalApplication hosting and serverless compute.
AnthropicAnthropic, PBCUSLLM inference for AI-assisted authoring.
GoogleGoogle LLCUS / globalLLM inference for image generation.
SentryFunctional Software, Inc.US / EUError monitoring and crash reporting.

How we notify

When we add or replace a subprocessor we update this page and email the owner of every active store at least 30 days before the new subprocessor begins processing. You can object on reasonable data-protection grounds — see the DPA § 5 for the process.