1. Who processes data on our behalf
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting the service and storing its data, including backups | Germany (European Union) |
| Postmark (ActiveCampaign) | Delivering sign-in links, invitations and any scheduled reports you switch on. It receives the recipient address and the content of that message | United States |
| Stripe | Taking subscription payments. Card details are entered on Stripe's own checkout page; we send an account identifier and the plan being purchased, and never see or store a card number | Ireland and United States |
Postmark (ActiveCampaign) only receives what we send it. There is no marketing automation here and no mailing list. The only email this software sends is a sign-in link, an invitation, or a scheduled report you switched on yourself.
2. Amazon
Amazon is not a sub-processor of ours in the ordinary sense: it is the source of your data and already holds it, and your relationship with it is your own. It is listed here because we send requests to it on your behalf and you should know which of its services we use.
- Selling Partner API: orders, finances, settlements, inventory, catalogue, returns, reimbursements, storage fees, sales and traffic reports and, where enabled, VAT transaction reports.
- Amazon Advertising API: campaigns, keywords, search terms, placements and performance. This uses a separate authorisation from the one above.
- What we send Amazon is your authorisation token and the parameters of the report or query being requested. We do not send Amazon anything about you that it did not already have.
3. External data providers
Vendira uses third-party data providers for public market signals such as search results, rankings and public product information. Requests to them carry public identifiers — a product's ASIN, a search term, the marketplace they belong to — never your name, your account or any financial figure. These sources supplement Amazon data and are never used to build your financial books.
4. Data sources that receive nothing
We read from the European Central Bank's published reference exchange rates to convert currencies. This is a one-way public download: no request we make to it contains customer data of any kind, so it is not a processor. It is named here for completeness, because a list that quietly omits an outbound connection is not a complete list.
5. Technologies not used
The service does not incorporate, and we do not disclose customer data to, any of the following:
- Analytics or product telemetry services.
- Error tracking or session replay services.
- Advertising or marketing pixels, and data brokers.
- Providers of large language models or other artificial intelligence services.
- Third-party support chat widgets.
- Third-party script or font hosting. Static assets are served from our own origin.
6. Changes to this list
We will update this page before a new sub-processor begins processing customer data, and we will notify account holders by email. If you object to a new sub-processor on reasonable data protection grounds, tell us at support@vendira.co and you may terminate without penalty for the remainder of your paid period.
This page forms part of our Privacy Policy.