1. Scope and status
This list describes the providers used for HYPRCART infrastructure and the services that may process Customer Personal Data. A conditional service receives that data only when used. Provider roles depend on the actual processing arrangement; our own subscription billing is separate from processing merchant buyer data on a Customer's behalf.
Provider terms and downstream registers below describe the wider processing chain. Their applicability depends on the contracted service and configuration. Adding or replacing a HYPRCART subprocessor remains subject to the DPA's prior notification and authorisation process; a change to a vendor's website is not, by itself, Customer authorisation.
2. Authorised subprocessors
| Provider | Purpose | Relevant personal data | Processing location | Provider terms and role |
|---|---|---|---|---|
| Cloudflare, Inc. Provider DPA Provider subprocessors | Hosting and edge delivery, Workers, security, DNS/networking, R2/KV/D1 storage, Hyperdrive, queues and platform runtime | Request and device metadata, IP addresses, security logs and Customer Personal Data handled by the enabled compute, storage and delivery services | Global edge network and service-specific storage/support locations; no blanket EEA-only processing commitment | Cloudflare DPA and its applicable transfer provisions; downstream providers depend on the Cloudflare services used |
| Neon — Databricks, Inc. / Neon, LLC Neon platform terms Provider subprocessors | Managed PostgreSQL for commerce shards, analytics-control and platform-control records, with backups and database operations | Merchant, buyer, staff, authentication, commerce and applicable control/audit records stored in the relevant database | Commerce configuration: AWS eu-central-1 (Frankfurt). Each database project's backup, control-plane and support locations follow its service configuration and provider terms | Current public Neon terms identify Databricks, Inc. and Neon, LLC and incorporate Databricks terms, with a Neon-specific schedule. The agreement applicable to the HYPRCART account governs the processing and transfer safeguards |
| Amazon Web Services EMEA SARL and affiliates Provider DPA Provider subprocessors | Amazon SES email delivery and associated delivery-event handling; Amazon Bedrock model inference (Anthropic Claude models) for AI tasks that the Customer's users start; infrastructure beneath other vendors is governed through those vendors | Recipient and sender addresses, message content and delivery, bounce, complaint and suppression information; for AI tasks, the instructions, tool results and generated output of each model call, including Customer Personal Data the task reads | Configured SES region: eu-central-1 (Frankfurt). Bedrock: EU cross-Region inference from eu-central-1, processed only in EU Regions (Frankfurt, Ireland, Paris, Stockholm, Milan, Spain). Recipient mail servers and provider support can be elsewhere | AWS data-processing terms and applicable transfer safeguards for the directly contracted email and AI model services. Bedrock invocation logging is off; AWS does not use prompts or outputs to train models and does not share them with the model provider |
| Typesense, Inc. Provider DPA Provider subprocessors | Hosted product search and indexing | Published catalogue content and any personal data included in it, plus request/IP and operational metadata; not a buyer-account database | Cluster region selected in Typesense Cloud; support and other processing locations are governed by the provider DPA | Typesense DPA, including applicable SCCs; the actual cluster region must be distinguished from a search endpoint's hostname |
| ClickHouse, Inc. and ClickHouse affiliates Provider DPA Provider subprocessors | Analytics warehouse, event and operational facts, rollups and query execution | Minimised commerce and analytics facts, pseudonymous visitor/session or subject references, and subject-linked dimensions where included | Service hosting region selected in ClickHouse Cloud; international support and affiliate access as described in its provider terms | ClickHouse DPA and applicable transfer safeguards. Pseudonymous analytical facts remain within the DPA when they relate to identifiable individuals |
| Stripe Payments Europe, Limited and Stripe affiliates Provider DPA Provider subprocessors | Conditional on use: Customer-enabled merchant payment and Connect functions; HYPRCART's own subscription billing is a separate controller activity | Contact, billing, payment, transaction, onboarding and fraud/security information required by the selected service | EEA, United States and other service, affiliate and support locations described by Stripe | Stripe's DPA distinguishes processor activities from its independent-controller activities. A direct merchant contract or regulated payment activity is not automatically a HYPRCART subprocessor relationship |
3. Customer-selected services and independent recipients
The following are not treated as HYPRCART subprocessors to the extent described:
- Payment networks, acquiring banks and regulated payment services: may act as independent controllers for legal, fraud and payment obligations.
- Public authorities: independent recipients for verification or legal compliance.
- A Customer's buyers, staff and business partners: recipients determined by the Customer through normal commerce operations.
Customer-installed apps, custom integrations and external identity providers are separate recipients where the Customer or user contracts with and instructs them directly. Selection alone does not determine the GDPR role. A provider engaged by HYPRCART to process Customer Personal Data for the Customer is subject to our DPA and subprocessor duties. AI tasks that the Customer runs with its own model-provider key (for example an Anthropic API key in the AI settings) are processed under the Customer's own contract with that provider and in that provider's locations, which can be outside the EEA; that provider is not a HYPRCART subprocessor.
4. Changes and objections
The prior notice, objection and authorisation procedure in Section 5 of the DPA applies to additions and replacements. We notify the Customer's account contact in writing at least 30 days before processing starts. An urgent replacement does not waive prior authorisation; specific written authorisation is needed where the normal process cannot be followed.
A Customer may object within 15 days on reasonable, documented data-protection grounds by emailing legal@hyprcart.com. The resolution and affected-service termination rights are in Section 5 of the DPA.
5. Contact
The provider links above include privacy contacts and downstream registers. We provide the applicable processor-chain identities, addresses, privacy contacts, processing locations and transfer information to Customers and keep that information current. Information necessary to assess data-protection compliance is not withheld solely because a vendor regards its contract as confidential.