Sub-processors
Last updated
Caelena Software Labs uses the services below to run MergeGuard for Shopify and its website. A sub-processor is a company that handles personal data on our behalf. This list is part of our Data Processing Agreement. How we use personal data is in the privacy policy.
The MergeGuard app
These services handle data from merchants’ stores, including their customers’ personal data.
| Service | What it does for MergeGuard | Data it handles |
|---|---|---|
| Railway | Hosts and runs the MergeGuard app | Customer and order data the app reads from Shopify |
| Neon | Postgres database: stores duplicate groups, History records and snapshots | Customer profile data, History records and snapshots |
| Upstash | Runs scans, merges and syncs in the background through its QStash job queue, and provides a Redis cache | Job messages for Shopify webhooks carry the customer record (name, email, phone, addresses, note, tags and marketing consent) and the order’s contact details (email, phone, browser IP address and shipping address). Email job messages carry the recipient’s email address, the subject line and the template data (store name, summary counts and plan details). Other job messages carry IDs only |
| Axiom | Keeps app logs so we can find and fix faults | IDs, and merchant-side details such as a merchant’s or staff member’s name or email. The app logs customers by ID rather than by contact details |
| Sentry | Error tracking for the app | Error reports, which can include the merchant user’s IP address, their Shopify user ID and details of the request that failed |
| PostHog | Product analytics: how merchants use the app’s screens | The store’s domain and events about how merchants use the app’s screens, keyed by an anonymous account ID. PostHog receives no customer names, email addresses, phone numbers or postal addresses |
| Resend | Sends the app’s emails from notifications@mergeguard.store: welcome, scan complete, uninstall feedback, allowance alerts, trial reminders and the digest | Recipient email addresses and the content of each email, such as summary counts |
| Web3Forms | Receives the sales enquiry form | What you type into the form |
The website
These services handle data about visitors to mergeguard.store. Details are in the cookie policy.
| Service | What it does | Data it handles |
|---|---|---|
| Vercel | Hosts the website and serves page requests | Page requests |
| PostHog | Website analytics on every visit | Page views, page speed and the site actions the cookie policy lists, with no name or email |
| Sentry | Error monitoring for the website | Error reports with page addresses stripped of query strings and fragments. IP address storage is switched off |
YouTube plays a video only after you click play. From then on, YouTube’s own privacy policy applies, as the cookie policy explains.
Services you connect
Klaviyo. If you connect your Klaviyo account, MergeGuard reads Klaviyo profiles to compare them with Shopify customers, and syncs lists to Klaviyo only when you choose. Connecting Klaviyo never auto-syncs. If you turn on Klaviyo merging, MergeGuard also asks Klaviyo to merge the Klaviyo profiles of the same customer after it merges that customer in Shopify. Klaviyo is your own provider: your agreement with Klaviyo covers the data held there.
Shopify. MergeGuard runs inside Shopify. Shopify holds your store and customer data and handles billing for MergeGuard. Your agreement with Shopify covers that data.
Changes to this list
When we add or replace a sub-processor, we email the store’s contact address 30 days before the new one starts. We also update this page and change the date at the top. To object, reply to that email. You can also uninstall MergeGuard at any time.
Questions: dpa@mergeguard.store.