MarginPatrol | Version 1.0 | Prepared 08 August 2026
Publication date: 02.09.2026. Effective date: 02.09.2026. Canonical page: https://marginpatrol.com/subprocessors.
1. Scope
This register describes providers used by the operator identified in the Legal Notice, trading as MarginPatrol, to operate the Service. A provider is a subprocessor only to the extent it processes Merchant Personal Data on MarginPatrol's behalf. Connected platforms acting for their own accounts or under a Merchant's instruction can have a different role.
Locations below describe the current service configuration or countries disclosed for the relevant service. Provider support, resilience and onward-provider access may involve additional locations under the applicable provider terms. A correspondence address is not a hosting location.
2. Current production providers
| Provider | Purpose | Data that may be processed | Current location or disclosed processing countries | Status |
|---|---|---|---|---|
| Supabase, Inc. | PostgreSQL database and private object storage | Authorised store and financial records, calculations, account/campaign metadata, encrypted credentials, audit records and generated files | Primary production database and storage in Frankfurt, Germany; provider operations may involve the United States and Singapore under applicable terms | Active |
| DigitalOcean, LLC | API, workers, scheduler and Redis hosting | Store operational and financial data, advertising-derived calculations, alerts and encrypted credentials while the application processes them | Frankfurt, Germany; provider operations may involve the United States | Active |
| Google LLC and applicable Google service entities | Cloud KMS, Secret Manager and Firebase Cloud Messaging | Application secrets, cryptographic operations, push payloads, device tokens and delivery metadata | Germany, Ireland and the United States, depending on service | Active |
| Twilio Inc. (SendGrid) | Transactional email and delivery events | Recipient address, operational message content and delivery metadata | United States and Germany under the applicable service configuration and provider terms | Active |
| Functional Software, Inc. (Sentry) | Redacted error diagnostics | Error codes, redacted stack traces, component names and request identifiers; no tokens, raw provider payloads or raw financial data | Sentry Germany ingestion endpoint for the reviewed production configuration | Active |
| PostHog, Inc. | Privacy-safe server-side product events | Event type, production environment and hashed store identifier; no customer data, tokens, raw store identifier or financial amount | European Union ingestion endpoint; current project delivery verified through the EU service | Active in production |
| Slack Technologies, LLC and applicable Slack entity | Merchant-enabled workspace notifications | Selected alert summary, workspace/channel identifiers and delivery metadata | United States, Germany, France and Ireland under the Merchant's selected workspace and applicable terms | Optional |
| Apple Inc. and applicable Apple service entities | Apple Push Notification service | Device token, permitted push payload and delivery metadata | United States and other locations used by the global APNs service under applicable terms | Active for iOS |
3. Connected platforms and other recipients
Shopify supplies authorised store data and operates Shopify accounts, Admin and app billing. Google Ads and other supported advertising platforms are Merchant-authorised data sources. Their role for their own platform service is not automatically that of a MarginPatrol subprocessor.
A Merchant-selected Slack workspace or other destination can independently retain a delivered copy under that Merchant's settings and the recipient's terms. Legal advisers and public authorities receive information only where separately necessary and lawful; they are not routine technical subprocessors.
4. Safeguards and changes
MarginPatrol restricts each provider to the functions and data categories needed for the Service, applies access controls and data minimisation, and uses the provider's applicable data-processing terms and transfer mechanisms where required. Copies or explanations of applicable safeguards may be requested at support@marginpatrol.com, subject to protection of confidential and security information.
Before an ordinary material new subprocessor begins handling affected Merchant Personal Data, MarginPatrol will update this register and provide the notice required by the applicable DPA or Merchant agreement. An urgent replacement needed to address a security or legal risk will be disclosed without undue delay. A Merchant may raise a reasonable data-protection objection under the DPA.
5. Register record
Register version: Version 1.0. Register owner: the operator identified in the Legal Notice. Contact: support@marginpatrol.com. Technical inventory reviewed: 12 September 2026. Next review is triggered by a provider, service, location, data category, contract or access change. The register is reviewed whenever a provider, service, location, data category, contract or access arrangement changes.