Policy
Subprocessors
Last updated: August 7, 2026
To run the Wehoz marketplace we rely on a handful of third-party services. Some process payments, some send transactional emails, some serve images close to the shopper. Each one receives a specific slice of data — not the whole picture — and we chose each one because of a track record of taking customer data seriously.
We update this list when we add, remove, or materially change a subprocessor. Material changes get a 30-day notice on this page before they take effect. The "last updated" date at the top of this page is authoritative; if you need notifications about future changes, write to privacy@wehoz.com and we will add you to our subprocessor-change mailing list.
| Subprocessor | Purpose | Data categories | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing, Connect Standard for seller payouts, Stripe Tax for sales-tax calculation, and Stripe Radar for fraud signals. | Customer name, billing address, email, masked card number, IP address; seller business name, EIN/SSN, bank account details. | United States (primary), with regional fallback in EU/AP per Stripe's global infrastructure. |
| Shippo, Inc. | Shipping rate quotes; label purchase from USPS, UPS, FedEx, and DHL; return-label issuance; delivery-tracking webhooks, including tracking numbers for labels sellers buy from their own carrier accounts. | Recipient name, ship-to address, parcel dimensions, declared value, tracking numbers. | United States. |
| Resend (BTS Software Solutions, Inc.) | Transactional and marketing email delivery, RFC 8058 one-click unsubscribe handling. | Recipient email address, email content, delivery and engagement events. | United States. |
| Supabase, Inc. | Primary database (PostgreSQL), authentication, and row-level security enforcement. | All customer and seller records, order data, encrypted PII (phone, tax IDs). | United States (us-east-1). |
| Cloudflare, Inc. | CDN, DDoS mitigation, edge Workers (api.wehoz.com), R2 object storage for product images and database backups, DNS, Workers Logs. | All HTTP requests, IP addresses, headers; product images; nightly database backups (encrypted). | Global edge network; backups stored in the United States. |
| Vercel, Inc. | Frontend application hosting (storefront, seller dashboard, admin console). | HTTP requests, build logs. | United States and regional edge. |
| PostHog, Inc. | Product analytics and feature flagging. Session replay is disabled in our configuration. | Hashed user identifier, page-view events, custom events, IP address. | United States. |
| Google LLC (Google Analytics 4) | Web analytics for the public storefront. | Page-view events, device and browser metadata, IP address (truncated). | Global. |
| UPCitemdb | GTIN/UPC enrichment lookups during product imports; results cached for 30 days. | Product GTIN/UPC codes (no personal data). | United States. |
| Sentry (Functional Software, Inc.) | Application error reporting and performance monitoring. | Stack traces, masked request payloads, browser metadata, IP address. | United States. |
| Typesense Cloud (Typesense Inc.) | Search indexing for product catalog. | Product catalog data (titles, descriptions, prices, attributes — public data). | United States. |
What we do not share
Customer data is not sold or rented to any party for advertising. Subprocessors above are bound by contract to use the data only to perform the service we hire them for. When a subprocessor wants to use the data for anything else, we negotiate that separately or we change subprocessor.
Sub-subprocessors
Several of the companies above use their own cloud infrastructure providers under the hood. Where that infrastructure provider would also receive customer data (typically encrypted in transit and at rest), we have reviewed the upstream contracts and they pass through equivalent protections. The biggest of these are Amazon Web Services and Google Cloud Platform, both of which power multiple subprocessors in the table.
Data residency questions
If you are running an audit or DPIA and you need exact regional details for a specific subprocessor, email privacy@wehoz.com with the subprocessor name and the question. We will reply within five business days with what we have on file.
How to object
GDPR and CCPA give you the right to object to a particular subprocessor. If you do, we will work with you to find a path forward — in some cases that means stopping a specific feature for your account, and in others (payment processing, for instance) it means we cannot continue to serve you. We will be straightforward about which is which, and we will give you a clean export of your data if we cannot continue.