Sub-processors

These vendors can reach personal data from the Klaviyo and Shopify accounts a brand connects. If you are a Serravee customer, this is the list that matters to you.

• Vercel — Hosting and CDN for serravee.com and the Serravee application. Data reached: Request metadata; account data in transit. Where: United States, global edge.
• Neon — The application database. Data reached: Account, experiment and connected-account data. Where: United States.
• Clerk — Sign-in and session management. Data reached: Operator names, email addresses, session cookies. Where: United States.
• Anthropic PBC — The model that drafts and analyses copy. Data reached: Campaign, copy and performance content sent in prompts. Where: United States.
• Resend — Transactional and product email. Data reached: Operator email addresses. Where: United States.

These vendors hold data about people who contact us or whom we contact about Serravee. Nothing a merchant connects reaches any of them. The separation is deliberate, and we list them separately so nobody has to guess which side of it a vendor is on.

• Railway — The database behind our website forms and internal tooling.
• Attio — Our CRM — prospect and customer contact records.
• Apollo.io — A source of business contact data about companies we may approach.
• Clay — Enrichment of that business contact data.
• Resend — Email to people who contact us, and internal alerts.

Apollo.io and Clay are not sub-processors in the usual sense. They do not process data we give them — they are where some of our business contact data comes from. What that means for you, if we contacted you, is set out under “If we contacted you about Serravee”.

Every vendor here is required to be bound by written data-protection terms no less protective than the commitments we make to you, and we remain fully liable to you for how each one performs those obligations.

We are completing that paperwork vendor by vendor alongside our SOC 2 work, and we would rather say that than claim a finished state we cannot show you. If you need the status for a specific vendor before you sign something, ask at privacy@serravee.com and we will tell you exactly where it stands.

We list vendors by the name you know them by. The full legal entity on each contract is a different string in some cases, and we would rather read it off the agreement than reproduce it from memory here — ask and we will send the exact entity and jurisdiction for any vendor on this page.

We update this page and email every customer at least 30 days before a new sub-processor starts processing your data. You do not need to ask to be notified — it comes with your account.

You may object on reasonable data-protection grounds within those 30 days. We will work with you to resolve it, and if we cannot, you may terminate the affected part of the service without penalty and take a pro-rata refund of anything you have prepaid.

Every change to the list above is logged here with the date it was published, so the 30-day notice is something you can check rather than something we assert. Boring entries stay in — a log with only interesting entries is not a log.

• 22 August 2026 — First published. Previously the list lived inside the Data Processing Agreement, and before that our privacy policy pointed at a list that did not exist.

We run no error-monitoring or analytics vendor. There is no Sentry-equivalent collecting our stack traces and no analytics script on this website. We mention it because stack traces routinely carry personal data by accident, so the honest answer to “which one do you use” is none — and this line is here to be wrong the day that changes.