Subprocessors
Version 22 September 2026. In force from that date.
A subprocessor is a company Ottom uses that can see personal data we hold. This page lists every one, what we use it for, which data it can see and where it processes it. It is the list our Privacy Policy and Data Processing Agreement refer to.
1. Current subprocessors
| Service | What we use it for | Personal data it can see | Where |
|---|---|---|---|
| Anthropic | Runs the AI models our agents use to read and judge a storefront. | Storefront content: product details and shipping and returns policy text. We do not send account details or screenshots. | United States |
| Stripe | Takes card payments, sends invoices and calculates tax. | Billing name, email and address, and payment details, which never reach our servers. | United States and European Union |
| Resend | Sends our email and receives email sent to our support address. | Email addresses, the content of the email, and whether it was delivered, opened or clicked. | United States |
| Cloudflare | Sits in front of the website: domain names, caching, protection from attacks, and sign-in for our own staff tools. | IP addresses and the details of each request to the website. | Global network, United States company |
| Sentry | Tells us when the software fails, so we can fix it. | Technical details of the failure, which can include an internal account number. Request bodies, cookies, and your email and IP address are removed before sending. | United States |
| PostHog | Counts how the product is used, such as scans started and plans chosen. | An internal account number and the event. No email address, and no cookies. | European Union |
| Google Analytics, only if you allow it on the cookie notice, and Sign in with Google if you choose it. | For analytics, page visits with identifiers removed from addresses. For sign-in, your Google account email and name. | United States | |
| Slack | Tells our team when a customer starts a scan, a trial or a plan, or cancels one. | The customer email address and the store address. | United States |
Our own servers, which hold the database and the scan recordings, are in the United Kingdom.
2. When we add one
We email the owners of paying accounts at least 30 days before a new subprocessor starts handling their personal data, and record the change below. If you object on reasonable data protection grounds, write to [email protected]. If we cannot resolve it, you may end the affected plan before the change and we refund what you prepaid for time after it ends.
3. Changes to this list
| Date | Change |
|---|---|
| 2026-09-22 | First published list. PostHog moved from its United States region to its European Union region on publication. |
Version history
- 22 September 2026 (in force): First published list.