Principles
MarginPatrol must keep the subprocessor list current, include purpose and data categories, avoid unnecessary subprocessors, review security and privacy posture and notify customers of material changes where required.
Required Categories
Expected subprocessor categories include hosting, database, object storage, email, push notifications, analytics, error monitoring, support tooling, Shopify billing and merchant-connected ad platforms.
Final vendor names, regions and status must match actual production services before launch.
Public Page Requirements
The public list should include last updated date, subprocessor name, purpose, data categories, location or hosting region where available, notice mechanism for changes and contact email.