Subprocessors
Last updated: September 28, 2026
PlatformDTC (Legalize Freedom LLC) uses the third parties below to process personal data on behalf of the merchants who use our platform and the customers who buy from them. Each is listed with the service it provides, the categories of personal data it may process, and its location.
Services we operate ourselves — including our own mail server, application servers and databases — are not subprocessors. The companies that host them are listed.
Change notifications
Every change to this list is added to the dated change log at the bottom of this page at least 30 days before a new subprocessor begins processing personal data, as the Data Processing Addendum requires. To be notified, subscribe to the Atom feed in any feed reader. Send questions or objections to contact@platformdtc.com.
For the security measures that apply to this processing, see Security. For how we handle personal data generally, see the Privacy Policy.
Infrastructure
Hosting, networking and storage for the PlatformDTC platform.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services (Amazon Web Services, Inc.) | Cloud hosting: application servers, the primary database, file storage, content delivery and backups. | All merchant account and store data, and customer data processed through stores — including names, email and postal addresses, phone numbers, orders and support messages. | United States — US East (N. Virginia) region |
| Cloudflare (Cloudflare, Inc.) | DNS, and the network proxy in front of the PlatformDTC API, documentation and status hosts. | Requests passing through its network, including IP addresses, request metadata, and the content of API requests and responses. | Global — requests are handled in the Cloudflare data center that receives them |
| Hetzner (Hetzner Online GmbH) | Hosting for PlatformDTC's own mail server, which sends automated and marketing email for stores and handles PlatformDTC mailboxes. | Sender and recipient email addresses and message content. | Germany (Nuremberg) |
Payments
Payment processing that PlatformDTC provides to stores directly.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe (Stripe, Inc.) | Card and wallet payment processing and account verification for stores on PlatformDTC Payments, storage of the cards shoppers save with DTCPay, billing for PlatformDTC subscriptions, and answering card-issuing banks when a cardholder queries or disputes a payment (Visa Order Insight and Compelling Evidence 3.0). | Customer names, email, billing and delivery addresses, and payment card details entered into Stripe's fields, including cards saved with DTCPay; transaction data, including the products bought and the IP address used to place the order; merchant business, identity and bank account details. | Entity in the United States |
Communications and sign-in
Delivery of messages that stores send to their customers, and account sign-in.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Twilio (Twilio Inc.) | Delivery of SMS messages that stores send to their customers, and of DTCPay verification codes by text message (Twilio Verify). | Mobile phone numbers and message content, including DTCPay verification codes. | Entity in the United States |
| Google Workspace (Gmail) (Google LLC) | Delivery of one-time sign-in codes for customer accounts on storefronts, and of DTCPay verification codes and account emails (welcome and removal link) by email. | Customer email addresses and the sign-in or verification code message. | Entity in the United States |
| Sign in with Google (Google LLC) — Only for merchants who sign in with Google. | Account sign-in for merchants who choose to sign in with Google. | Name, email address and Google account identifier. | Entity in the United States |
AI models
Models behind PlatformDTC's agents and store builder.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Bedrock (Amazon Web Services, Inc.) | AI models for PlatformDTC's in-product agents, including the customer support agent and the store builder. | Prompts and content given to the agents, which can include customer support messages and the names and email addresses in them, and merchant store content. | United States regions. Requests that use Amazon Bedrock global cross-Region inference can be processed in any AWS commercial Region. |
| OpenRouter (OpenRouter, Inc.) — Only for stores that use the support email agent. | AI model access for the support email agent, which drafts replies to customer emails. | Customer support email content, including the names and email addresses in it. | Entity in the United States. Each request is processed by the model provider OpenRouter routes it to. |
| OpenCode Zen (Anomaly Innovations, Inc.) | AI models for the store builder, which creates and edits storefront pages from merchant instructions. | Merchant prompts and store content, such as product and page text. | Entity in the United States |
Analytics
Measurement of how our website, dashboard and hosted checkout are used.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Google Analytics (Google LLC) | Usage analytics for platformdtc.com, the merchant dashboard and PlatformDTC-hosted checkout. | Device and browser information, pages viewed and interactions, and approximate location derived from IP address. | Entity in the United States |
Payment processors a merchant connects
A merchant can connect their own account with the payment providers below. For that store, customer payment data is processed by the provider under the merchant’s own agreement with it, so these providers are not PlatformDTC subprocessors:
- Stripe (a merchant’s own Stripe account)
- PayPal
- Authorize.net
- Checkout.com
- MyFatoorah
The same applies to other services a merchant connects to their store, such as advertising platforms and fulfillment providers.
Change log
- September 28, 2026 — No new subprocessor. For DTCPay, the shopper wallet: Stripe's purpose now includes storing the cards saved with DTCPay; Twilio's now includes sending DTCPay verification codes by text message, through Twilio Verify; and Google Workspace's now includes sending DTCPay verification codes and DTCPay welcome emails by email. The DTCPay Terms are at platformdtc.com/legal/dtcpay.
- September 11, 2026 — Stripe's purpose now includes answering card-issuing banks when a cardholder queries or disputes a payment. The products bought, the delivery address and the IP address used to place the order are sent with the payment, so a Visa issuer can recognise the purchase and, under Compelling Evidence 3.0, compare it with the cardholder's earlier undisputed orders.
- September 11, 2026 — First publication of the PlatformDTC subprocessor list: Amazon Web Services (including Amazon Bedrock), Cloudflare, Hetzner, Stripe, Twilio, Google (Workspace, Sign in with Google and Analytics), OpenRouter and OpenCode Zen.