Sub-processors — Subnotice
Processor: MINISAGE TECH LTD
URL: https://subnotice.com/sub-processors
Version: 1.5 · 18 July 2026 — supersedes v1.4 (5 July 2026)
Notify merchants 30 days before adding a new sub-processor. Update this file and the DPA Annex 2 simultaneously.
Pending addition — UNREVIEWED DRAFT, added 2026-08-02, awaiting counsel review. The Shopify row's "Data processed" column below has been extended to disclose that Subnotice sends Shopify billing-attempt instructions (not only OAuth/session data) once the native billing engine is enabled. This is drafting only — it is not adopted as part of the live v1.5 disclosure, and the version number above is deliberately not bumped, pending the same sign-off gate as
DPA_TOS_AMENDMENTS_Q9_02-08-2026.md(§4(b)) andQ9_COUNSEL_REVIEW_PACK_02-08-2026.md. Do not treat the added text as accurate, complete, or in effect until counsel/founder sign off and this file's version is formally bumped. No other row in this file has been changed.
Current sub-processors
| Sub-processor | Service | Location | Data processed |
|---|---|---|---|
| Neon Tech Inc. | PostgreSQL database (encrypted at rest) | EU — Frankfurt region | Shopify session and shop operational data; customer subscription snapshot; exact notice artifacts; terms observations; provider receipt payloads; pseudonymous contract/HMAC identifiers; event hashes and delivery/engagement timeline; WooCommerce site/reminder records |
| Vercel Inc. | Application + website hosting, serverless functions (compute, TLS termination) | US (region per project config) | Same application data in transit during compute/export; policy text submitted to the audit API (processed in memory, not stored by Subnotice); standard platform HTTP request logs (IP, path, timestamp) |
| Resend Inc. | Transactional reminder email delivery, delivery/open-event webhooks | US | Customer name and email address; reminder subject/body; provider message/event identifiers; delivery/bounce/open events, subject to Resend's service retention terms |
| Shopify Inc. | Platform OAuth, API, webhooks, App billing | Canada / global | Merchant staff session via OAuth; Shopify acts as independent controller for its own platform data. [UNREVIEWED DRAFT addition, 2026-08-02 — pending counsel review, not yet in effect] Where the Controller enables Subnotice's native billing engine, Subnotice also sends Shopify billing-attempt instructions — subscription contract reference, billing-cycle date, requested charge amount/currency, and an idempotency key — via Shopify's subscriptionBillingAttemptCreate API, and separately queries Shopify for the resulting attempt status (succeeded / failed / requires action) and, on success, the resulting order reference and amount actually charged. Subnotice does not send or receive card data in this call; see DPA §2 (as amended, pending) |
| Freemius Inc. | WooCommerce plugin licensing/billing (paid "Compliance Complete" tier only, not yet released for purchase) | US | Merchant site URL, hashed API token, declared jurisdiction, reply-to email (once released) |
Evidence for the pending Shopify-row addition above (verified in code as of 2026-08-02, not asserted as legally sufficient): the only file in the codebase that calls a charge-triggering Shopify API is app/uk-subscription-guard/app/lib/billing/shopify-billing-executor.server.ts. Its submit() method (lines 251–288) calls the subscriptionBillingAttemptCreate GraphQL mutation (defined lines 71–125), sending contractId, idempotencyKey, originTime, and billingCycleSelector.date as input; its pollStatus() / findRecentAttempt() methods (lines 290–346) query Shopify for the resulting attempt state, order id, and charged amount/currency. app/uk-subscription-guard/app/lib/billing/charge-executor.ts (lines 1–17) records this as the sole locked production charge path (SHOPIFY_BILLING_ATTEMPT_AUTHORITY, 2026-07-18). No raw card fields (cardNumber, cvv, pan, or equivalents) are constructed or sent anywhere in this file or elsewhere under app/lib/billing/.
Removed / never used
| Sub-processor | Reason |
|---|---|
| Fly.io | Not selected |
| Supabase Inc. | Not selected; using Neon instead |
| Render Services Inc. | Listed in v1.1 in error / superseded — hosting is Vercel; never processed production data |
Change log
| Date | Change |
|---|---|
| 2026-05-19 | Initial skeleton v1.0 |
| 2026-05-26 | v1.1 — filled in MINISAGE TECH LTD; confirmed Neon EU + Render US; removed unused Fly/Supabase; moved Resend to planned |
| 2026-07-02 | v1.2 — corrected hosting: Render → Vercel Inc. (actual host of app.subnotice.com, subnotice.com, and the /api/audit endpoint); added policy-text-in-transit + platform request logs to Vercel data column (checker/Woo plugin flows). 0 live merchants at time of change — no 30-day notice cycle triggered |
| 2026-07-04 | v1.3 — Resend Inc. moved from "planned" to current/active (reminder-email + delivery/open-tracking features shipped and live); this file was stale relative to Privacy Policy v1.2 §4 and DPA v1.1 Annex 2, which already listed Resend as current. 0 live merchants at time of change — no 30-day notice cycle triggered |
| 2026-07-05 | v1.4 — added Freemius Inc. (WooCommerce paid-tier licensing/billing, not yet released for purchase — added now so this file and DPA Annex 2 aren't stale relative to Privacy Policy v1.4 the moment it published); corrected Neon's data column to include the customer subscription snapshot and WooCommerce site record (both were already disclosed in Privacy Policy/DPA but missing here); corrected stale "read live, not persisted" framing on Resend's row (customer data is persisted upstream in Neon; Resend itself still doesn't persist it, wording just clarified). 0 live merchants at time of change — no 30-day notice cycle triggered |
| 2026-07-18 | v1.5 — added Evidence Assistant categories (exact notice artifacts, terms observations, provider receipt payloads, pseudonymous identifiers and hashes); removed the unsupported claim that Resend never persists message content; no new sub-processor added |
| 2026-08-02 | DRAFT NOTE (not adopted, no version bump): Shopify row's "Data processed" column drafted to disclose billing-attempt instructions (Q9 native-billing gate); pending counsel review — see DPA_TOS_AMENDMENTS_Q9_02-08-2026.md §4(b). File remains live at v1.5 until this is reviewed and formally adopted. No new sub-processor added — Shopify was already listed |