Sub-processors
Last Updated: October 19, 2026
Buy Box Checker uses the third-party providers below to deliver the Service. This page is referenced by Section 14 of our Terms of Service and supplements our Privacy Policy.
We will email the privacy contact for each customer whose use is governed by our DPA at least 30 days before a new or replacement Subprocessor begins processing Customer Personal Data. The notice will identify the provider and its role. During that period, the customer may object on reasonable data-protection grounds by emailing help@buyboxchecker.com. Section 8.3 of the DPA describes the objection process and available remedies. For other data-processing questions, contact help@buyboxchecker.com.
Separately from the providers below, some pages load content directly from third parties, which means those parties see your IP address and request metadata: Amazon's image CDN for product images in the dashboard, jsDelivr for map outlines on public Buy Box check results and in the dashboard location map, and YouTube for video thumbnails and, when you press play, the embedded player. They act under their own privacy policies.
Our Website also uses the Meta Pixel from Meta Platforms, Inc. to measure our advertising. Meta is not our sub-processor: it receives page views, button clicks, Buy Box check, sign-up, and purchase events, IP addresses, and cookie identifiers, and uses them under its own terms as an independent controller. When marketing cookies were allowed when a customer started checkout, our server may also send Meta that customer's subscription purchase through Meta's Conversions API, with Meta's cookie identifiers, the browser's user agent and the email address used at checkout in hashed form. It runs only when marketing cookies are allowed in a visitor's browser and the browser does not send a Global Privacy Control signal. A browser that allows analytics but not marketing may still download Meta's pixel file, which gives Meta its IP address and browser information but no events. Opening a sign-in, sign-up, account setup, or dashboard page directly does not load the pixel, and when a visitor reaches one from another of our pages without a full page reload, we switch the pixel off before it sends anything for that page and discard what it held for those pages before we switch it back on, so that no page view or button click for those pages is sent to Meta. There are two exceptions: creating an account runs the pixel on the sign-up page, and buying a subscription runs it on the dashboard page the customer returns to after checkout. Section 4 of our Privacy Policy describes what it receives.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database and user authentication | Account data, monitoring configuration, monitoring history, agreement records, and sign-in records including IP addresses | United States |
| Vercel | Application hosting and content delivery | Request metadata, IP addresses | United States |
| Stripe | Payment processing and subscription billing | Billing name, email, address, transaction history, your plan and account identifier, whether you are an Ad Badger customer, your business name and the Terms and DPA versions you accepted at checkout, your analytics and marketing cookie choices when you started checkout and, if analytics was allowed, your Google Analytics cookie identifiers and, if marketing was allowed and we report purchases to Meta, your Meta cookie identifiers and browser user agent, and a First Promoter referral ID if you arrived through an affiliate link. Your full card number and security code go directly to Stripe and never reach our servers. When our servers ask Stripe whether you have a card on file, Stripe's answer includes the card's brand, last four digits and expiry date and the billing details saved with it; we use the answer only to see that a card exists and store none of it. | United States |
| Amazon data collection provider | Collection of public Amazon product page data | ASINs and monitoring locations submitted to the collector, and public Amazon product-page data returned for those requests. Returned data may include seller names or identifiers that constitute personal data in context. | European Union |
| Resend | Transactional and daily digest email delivery, including the results of a public Buy Box check emailed to the address entered on its result page, contact-form messages forwarded to our support mailbox, and internal billing and operations alerts sent to our own team | Email address, message content. Internal alerts can include a customer's email address, account identifier, plan, price, Stripe customer, subscription and checkout identifiers, scheduled cancellation date and cancellation reason, and, when a background job fails, the ASIN, seller name and monitoring location being checked | United States |
| Inngest | Background job orchestration for checks, digests and daily billing reconciliation | Job payloads and step results: account identifiers, ASINs and monitoring locations, and the seller name of the brand being checked; for daily digests, the recipient email address, your plan, your digest settings (including any webhook URL you entered) and the digest content; and for the daily billing reconciliation, the email address, plan, ASIN limit, Stripe customer and subscription identifiers, subscription price, the number of checks billed on a custom partner deal, and any scheduled cancellation date of each account with a subscription or a paid plan | United States |
| PostHog | Product analytics for the Website, the signed-in dashboard, and our MCP connector | Page views and clicks (without the text of what you click), page addresses (dashboard addresses can include brand identifiers and ASINs, and after checkout your plan and a checkout reference), the site's own events such as starting a Buy Box check, signing up, or buying a subscription (for a purchase: the plan, its list price, the currency, and a checkout reference), device and browser metadata, IP address and the approximate location derived from it, and your user ID, email address and plan when you are signed in. Name and email address from the contact form. For MCP connector calls: the tool name, whether it succeeded, how long it took, and your user ID, not the tool's inputs or results. From our server, when a subscription purchase completes and analytics cookies were allowed when checkout started: your user ID, the plan, its list price, the amount charged, the currency and a checkout reference. In the browser it loads only when analytics cookies are allowed. The PostHog project is shared with Ad Badger's other products. | United States |
| Google (Analytics and Tag Manager) | Website traffic analytics | Pseudonymous usage events (pages viewed, including dashboard pages, and events such as starting a Buy Box check, pressing a form button, signing up, or buying a subscription, with the plan, its list price, the currency, and a checkout reference), cookie identifiers, device and browser metadata, and IP address. When marketing cookies are also allowed, Google Analytics is set to look for contact details (an email address, phone number or postal address) in forms on any page, including sign-in, sign-up and dashboard pages, and to send any it finds to Google in hashed form with those events. Tag Manager loads when analytics or marketing cookies are allowed; Google Analytics collects only when analytics cookies are allowed. When a subscription purchase completes and analytics cookies were allowed when checkout started, our server also sends Google Analytics the purchase event (the plan, its list price, the currency and a checkout reference) with your Google Analytics cookie identifiers. | United States |
| Google (Gemini API) | AI summaries of your account data, and automated replies from the AI assistant in our support chat | For summaries: your monitoring data at the time of generation, including your brand and seller names, the ASINs and product names you track, per-location Buy Box status including city or postcode, and competing seller names and prices. For support chat: the messages in your conversation. | United States |
| Anthropic | The AI coding assistant our engineers use to run investigation scripts and database queries | What those scripts and queries return, which can include account data such as email addresses, brands, ASINs and seller names | United States |
| Cloudflare | DNS, and bot protection (Turnstile) on the public Buy Box check and the contact form | IP address, browser and request metadata | United States |
| Chatwoot (self-hosted by us) | Customer support chat and email. Chats may be answered by an AI assistant (see Google (Gemini API)). In the UK, the European Economic Area and Switzerland the chat widget loads only when you click the chat button; elsewhere it loads on every page. | Name, email address, conversation content; the IP address and browser details of each visitor the widget loads for; for signed-in users also your user ID, email address, plan and account identifier, so support can find your account; and, because it reads our support mailbox, any internal alerts delivered there (see the Resend row) | United States (Oregon) |
| Hetzner | Server hosting for the self-hosted Chatwoot instance above | Whatever Chatwoot stores, at rest on their infrastructure | United States (Oregon) |
| Google (Workspace) | Hosting of our help@buyboxchecker.com mailbox, which receives support email, contact-form messages, privacy requests, and, unless we have set another address for them, our internal billing and operations alerts | Name, email address, message content, and attachments. Internal alerts can include the customer details listed in the Resend row | United States and other Google data-center locations |
| FirstPromoter | Referral and affiliate attribution | Referral codes, visits from affiliate links, and conversion events for customers who arrived through one; for enrolled affiliates, email address and account identifier. Its script loads on every page whenever marketing cookies are allowed and the browser does not send a Global Privacy Control signal, so it also receives those visitors' IP addresses. | European Union |