Sub-processors.
The companies that process personal data for us when we deliver CMTools Returns and AMED to a store. Last updated 3 November 2026.
| Company | Used for | Service | Data location | Transfer safeguard |
|---|---|---|---|---|
| Anthropic Ireland, Limited | The AI model behind AMED and the files users upload to it | AMED | EU company; processing in the USA | Standard contractual clauses |
| BunnyWay d.o.o. (Bunny Fonts) | Web fonts on the return portal | Returns | EU (Slovenia) | Not needed (EU) |
| Cloudflare, Inc. | Forwarding email sent to our support address | Returns, AMED | Global network | EU–US Data Privacy Framework |
| Functional Software, Inc. (Sentry) | Error monitoring | Returns | EU (Germany) | EU–US Data Privacy Framework |
| Microsoft Ireland Operations Limited (Microsoft 365) | Email with customers about support | Returns, AMED | EU | EU–US Data Privacy Framework and standard contractual clauses |
| MongoDB, Inc. (Atlas) | Database and file storage | Returns | EU (Sweden) | EU–US Data Privacy Framework |
| Salesforce, Inc. (Heroku) | Hosting the applications, and AMED's database | Returns, AMED | EU (Ireland) | EU–US Data Privacy Framework |
| Twilio Inc. (SendGrid) | Sending email | Returns, AMED | USA | EU–US Data Privacy Framework |
Changes
Stores that have signed our data processing agreement get an email 30 days before we add or replace a sub-processor, and can object in that time.
Not on this list
Shopify, carriers such as PostNord, Bring, DHL and UPS, warehouse systems such as Ongoing, and the ad and analytics platforms AMED reads from. The store chooses these and holds its own agreements with them. Our services send data to them, or read from them, on the store's instruction.
Questions go to [email protected].