Subprocessor List
Effective Date: April 27, 2026
Version: Public v1.0
This Subprocessor List identifies categories of third-party service providers that may process Customer Data or Personal Data on behalf of FireGroup JSC (“Company“) in connection with the provision of Transcy, OneMobile, OneLoyalty, and related services (collectively, the “Services“).
This list is provided for transparency and may be updated from time to time as our products, infrastructure, vendors, and operational needs evolve.
Important Notes:
– This list is intended to be read together with our Terms and Conditions, Privacy Policy, and Data Processing Addendum.
– Not every subprocessor listed below will process data for every customer, product, plan, or region.
– Certain Third-Party Services may be engaged directly by the customer, including through customer-selected integrations or customer-supplied API keys. Where those providers are engaged directly by the customer, they may act independently under the customer’s own contractual relationship and may not always be acting as the Company’s subprocessor.
– Some providers may process data from multiple locations depending on service configuration, redundancy, support model, or regional service selection.
– Where required by applicable law or contract, we may provide notice of material changes to this list.
1. Core Infrastructure and Hosting
1.1 Amazon Web Services (AWS)
Purpose / Service: Cloud infrastructure, hosting, storage, networking, backup, and related infrastructure services.
Categories of Data Potentially Processed: Account data, Customer Data, technical logs, support-related data, application data, backups.
Primary Location / Region: United States.
1.2 Cloudflare
Purpose / Service: Content delivery, web optimization, DNS, security, traffic filtering, and related infrastructure services.
Categories of Data Potentially Processed: IP address, device and request metadata, technical logs, website traffic data.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
Purpose / Service: Cloud infrastructure, hosting, storage, networking, backup, and related infrastructure services.
Categories of Data Potentially Processed: Account data, Customer Data, technical logs, support-related data, application data, backups.
Primary Location / Region: United States.
1.2 Cloudflare
Purpose / Service: Content delivery, web optimization, DNS, security, traffic filtering, and related infrastructure services.
Categories of Data Potentially Processed: IP address, device and request metadata, technical logs, website traffic data.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
2. Monitoring, Error Tracking, and Analytics Infrastructure
2.1 Sentry
Purpose / Service: Error tracking, diagnostics, performance monitoring, and debugging.
Categories of Data Potentially Processed: Technical logs, error traces, device and browser data, metadata, limited. Customer Data included in error context.
Primary Location / Region: Vietnam.
2.2 Google Analytics
Purpose / Service: Website and product analytics.
Categories of Data Potentially Processed: IP address, device/browser data, usage data, cookie identifiers, traffic and engagement data.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
2.3 Google Tag Manager
Purpose / Service: Tag and script management.
Categories of Data Potentially Processed: Website interaction data, technical event metadata, cookie-related information.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
2.4 Amplitude
Purpose / Service: Product analytics and event measurement.
Categories of Data Potentially Processed: Event data, device identifiers, usage patterns, account or pseudonymous identifiers, app interaction data.
Primary Location / Region: United States.
2.5 Microsoft Clarity
Purpose / Service: Product analytics and event measurement.
Categories of Data Potentially Processed: Event data, device identifiers, usage patterns, account or pseudonymous identifiers, app interaction data.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
Purpose / Service: Error tracking, diagnostics, performance monitoring, and debugging.
Categories of Data Potentially Processed: Technical logs, error traces, device and browser data, metadata, limited. Customer Data included in error context.
Primary Location / Region: Vietnam.
2.2 Google Analytics
Purpose / Service: Website and product analytics.
Categories of Data Potentially Processed: IP address, device/browser data, usage data, cookie identifiers, traffic and engagement data.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
2.3 Google Tag Manager
Purpose / Service: Tag and script management.
Categories of Data Potentially Processed: Website interaction data, technical event metadata, cookie-related information.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
2.4 Amplitude
Purpose / Service: Product analytics and event measurement.
Categories of Data Potentially Processed: Event data, device identifiers, usage patterns, account or pseudonymous identifiers, app interaction data.
Primary Location / Region: United States.
2.5 Microsoft Clarity
Purpose / Service: Product analytics and event measurement.
Categories of Data Potentially Processed: Event data, device identifiers, usage patterns, account or pseudonymous identifiers, app interaction data.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
3. Customer Support and Communications
3.1 Crisp
Purpose / Service: Customer support chat, ticketing, and related communication workflows.
Categories of Data Potentially Processed: Name, email address, support messages, chat transcripts, device/browser metadata, support attachments.
Primary Location / Region: European Union.
3.2 MailGun
Purpose / Service: Transactional email, support communications, and relationship management.
Categories of Data Potentially Processed: Business contact data, communication history, marketing preferences, support-related records.
Primary Location / Region: United States.
Purpose / Service: Customer support chat, ticketing, and related communication workflows.
Categories of Data Potentially Processed: Name, email address, support messages, chat transcripts, device/browser metadata, support attachments.
Primary Location / Region: European Union.
3.2 MailGun
Purpose / Service: Transactional email, support communications, and relationship management.
Categories of Data Potentially Processed: Business contact data, communication history, marketing preferences, support-related records.
Primary Location / Region: United States.
4. AI, Translation, and Automated Processing Providers
The providers in this section may be involved depending on the relevant Service, feature, customer configuration, plan, and whether a customer uses its own API key or Company-managed access.
4.1 OpenAI
Purpose / Service: AI-assisted text generation, transformation, summarization, localization support, and related language processing.
Categories of Data Potentially Processed: Prompts, source text, generated outputs, metadata, technical usage information.
Primary Location / Region: United States.
4.2 Google Translate / Google Cloud Translation
Purpose / Service: Machine translation and related language services.
Categories of Data Potentially Processed: Source text, translated text, metadata, language-related usage data.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
4.3 DeepL
Purpose / Service: Machine translation and language processing.
Categories of Data Potentially Processed: Source text, translated text, metadata, usage data.
Primary Location / Region: European Union.
4.4 Baidu
Purpose / Service: Translation or AI-related language processing.
Categories of Data Potentially Processed: Source text, translated text, prompts, outputs, metadata.
Primary Location / Region: China.
4.5 Yandex
Purpose / Service: Translation or AI-related language processing.
Categories of Data Potentially Processed: Source text, translated text, prompts, outputs, metadata.
Primary Location / Region: Russia.
4.6 DeepSeek
Purpose / Service: AI-assisted language or content processing.
Categories of Data Potentially Processed: Prompts, source text, generated outputs, metadata.
Primary Location / Region: China.
4.7 Grok / xAI
Purpose / Service: AI-assisted language or content processing.
Categories of Data Potentially Processed: Prompts, source text, generated outputs, metadata.
Primary Location / Region: United States.
4.8 Claude
Purpose / Service: AI-assisted features, if applicable.
Categories of Data Potentially Processed: Prompts, outputs, metadata, feature-specific data.
Primary Location / Region: United States.
Important: When a customer uses its own API key or direct account with one of the providers above, that provider may be engaged under the customer’s own relationship and terms. In such cases, the provider may not be acting solely as the Company’s subprocessor.
4.1 OpenAI
Purpose / Service: AI-assisted text generation, transformation, summarization, localization support, and related language processing.
Categories of Data Potentially Processed: Prompts, source text, generated outputs, metadata, technical usage information.
Primary Location / Region: United States.
4.2 Google Translate / Google Cloud Translation
Purpose / Service: Machine translation and related language services.
Categories of Data Potentially Processed: Source text, translated text, metadata, language-related usage data.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
4.3 DeepL
Purpose / Service: Machine translation and language processing.
Categories of Data Potentially Processed: Source text, translated text, metadata, usage data.
Primary Location / Region: European Union.
4.4 Baidu
Purpose / Service: Translation or AI-related language processing.
Categories of Data Potentially Processed: Source text, translated text, prompts, outputs, metadata.
Primary Location / Region: China.
4.5 Yandex
Purpose / Service: Translation or AI-related language processing.
Categories of Data Potentially Processed: Source text, translated text, prompts, outputs, metadata.
Primary Location / Region: Russia.
4.6 DeepSeek
Purpose / Service: AI-assisted language or content processing.
Categories of Data Potentially Processed: Prompts, source text, generated outputs, metadata.
Primary Location / Region: China.
4.7 Grok / xAI
Purpose / Service: AI-assisted language or content processing.
Categories of Data Potentially Processed: Prompts, source text, generated outputs, metadata.
Primary Location / Region: United States.
4.8 Claude
Purpose / Service: AI-assisted features, if applicable.
Categories of Data Potentially Processed: Prompts, outputs, metadata, feature-specific data.
Primary Location / Region: United States.
Important: When a customer uses its own API key or direct account with one of the providers above, that provider may be engaged under the customer’s own relationship and terms. In such cases, the provider may not be acting solely as the Company’s subprocessor.
5. Currency, Pricing, and Related Data Providers
5.1 fixer.io
Purpose / Service: Currency exchange rate, pricing, and related display services.
Categories of Data Potentially Processed: Currency pairs, pricing context, localization settings, technical request metadata.
Primary Location / Region: European Union.
Purpose / Service: Currency exchange rate, pricing, and related display services.
Categories of Data Potentially Processed: Currency pairs, pricing context, localization settings, technical request metadata.
Primary Location / Region: European Union.
6. Push Notification and Mobile App Services
6.1 Apple App Store Connect / Apple-related publishing services
Purpose / Service: iOS app publishing and distribution support.
Categories of Data Potentially Processed: Developer account data, app metadata, app assets, limited user or operational data where applicable.
Primary Location / Region: Global (including the United States and European Union).
6.2 Google Play Console / Google-related publishing services
Purpose / Service: Android app publishing and distribution support.
Categories of Data Potentially Processed: Developer account data, app metadata, app assets, limited user or operational data where applicable.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
6.3 Firebase Cloud Messaging (if applicable)
Purpose / Service: Push notification delivery and related messaging support.
Categories of Data Potentially Processed: Device tokens, push metadata, message delivery data, app identifiers.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
6.4 Apple Push Notification service — APNs (if applicable)
Purpose / Service: Push notification delivery for iOS apps.
Categories of Data Potentially Processed: Device tokens, push metadata, app identifiers.
Primary Location / Region: Global (including the United States and European Union).
Purpose / Service: iOS app publishing and distribution support.
Categories of Data Potentially Processed: Developer account data, app metadata, app assets, limited user or operational data where applicable.
Primary Location / Region: Global (including the United States and European Union).
6.2 Google Play Console / Google-related publishing services
Purpose / Service: Android app publishing and distribution support.
Categories of Data Potentially Processed: Developer account data, app metadata, app assets, limited user or operational data where applicable.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
6.3 Firebase Cloud Messaging (if applicable)
Purpose / Service: Push notification delivery and related messaging support.
Categories of Data Potentially Processed: Device tokens, push metadata, message delivery data, app identifiers.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
6.4 Apple Push Notification service — APNs (if applicable)
Purpose / Service: Push notification delivery for iOS apps.
Categories of Data Potentially Processed: Device tokens, push metadata, app identifiers.
Primary Location / Region: Global (including the United States and European Union).
7. Platform and Ecosystem Providers
7.1 Shopify
Purpose / Service: App platform, API integrations, store connection, billing, and ecosystem-related services.
Categories of Data Potentially Processed: Store data, merchant account data, operational data, app-related metadata, usage data.
Primary Location / Region: Global (including the United States, Canada, and European Union).
Purpose / Service: App platform, API integrations, store connection, billing, and ecosystem-related services.
Categories of Data Potentially Processed: Store data, merchant account data, operational data, app-related metadata, usage data.
Primary Location / Region: Global (including the United States, Canada, and European Union).
8. Marketing, Advertising, and Attribution Providers
8.1 Google Ads
Purpose / Service: Advertising, conversion measurement, and campaign attribution.
Categories of Data Potentially Processed: Cookie identifiers, traffic and engagement data, conversion events, IP address, technical metadata.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
8.2 Meta / Facebook-related tools (if applicable)
Purpose / Service: Login, remarketing, audience measurement, and campaign attribution.
Categories of Data Potentially Processed: Cookie or advertising identifiers, engagement data, device/browser data, account-linked metadata where applicable.
Primary Location / Region: Global (including the United States and European Union).
8.3 Shopify Ads for Shopify App Store
Purpose / Service: Campaign performance and attribution.
Categories of Data Potentially Processed: Advertising identifiers, event data, traffic data, conversion-related metadata.
Primary Location / Region: Global (including the United States, Canada, and European Union).
Purpose / Service: Advertising, conversion measurement, and campaign attribution.
Categories of Data Potentially Processed: Cookie identifiers, traffic and engagement data, conversion events, IP address, technical metadata.
Primary Location / Region: Global (including the United States, European Union, and Asia-Pacific regions).
8.2 Meta / Facebook-related tools (if applicable)
Purpose / Service: Login, remarketing, audience measurement, and campaign attribution.
Categories of Data Potentially Processed: Cookie or advertising identifiers, engagement data, device/browser data, account-linked metadata where applicable.
Primary Location / Region: Global (including the United States and European Union).
8.3 Shopify Ads for Shopify App Store
Purpose / Service: Campaign performance and attribution.
Categories of Data Potentially Processed: Advertising identifiers, event data, traffic data, conversion-related metadata.
Primary Location / Region: Global (including the United States, Canada, and European Union).
9. Customer-Selected Integrations
Customers may choose to connect additional third-party applications, analytics tools, APIs, or service providers on or outside the Shopify ecosystem. Those integrations are enabled at the customer’s direction.
Such providers may receive Customer Data or Personal Data depending on the configuration selected by the customer. In many cases, those providers operate under the customer’s own agreement and privacy terms and may not be acting as the Company’s subprocessor.
Customers are responsible for reviewing and approving the privacy and security posture of any customer-selected integration.
Such providers may receive Customer Data or Personal Data depending on the configuration selected by the customer. In many cases, those providers operate under the customer’s own agreement and privacy terms and may not be acting as the Company’s subprocessor.
Customers are responsible for reviewing and approving the privacy and security posture of any customer-selected integration.
10. International Data Transfers
Some subprocessors may process data outside the EEA, UK, Switzerland, or the customer’s local jurisdiction. Where required by applicable law, the Company uses appropriate safeguards for cross-border transfers, which may include Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions, contractual commitments, or other lawful transfer mechanisms.
11. Change Management
We may update this Subprocessor List from time to time to reflect changes in our infrastructure, vendors, service providers, or product functionality. The "Last Updated" date above reflects the date of the latest revision.
Where required by applicable law or contract, we may provide notice of material changes through email, in-product notice, or related legal documentation.
Where required by applicable law or contract, we may provide notice of material changes through email, in-product notice, or related legal documentation.
12. Contact
For subprocessor questions, privacy inquiries, DPA requests, or related compliance matters, please contact:
FireGroup JSC
F21-22, 182 Le Dai Hanh St., Ward 15, District 11, HCMC.
FireGroup JSC
F21-22, 182 Le Dai Hanh St., Ward 15, District 11, HCMC.
13. Other Legal Documents
We encourage you to review the following related legal documents so you better understand your rights, how your data is protected, and what to expect from our services:
– Terms and Conditions: The overall binding agreement governing your use of Transcy’s services.
– Privacy Policy: How we collect, use, and safeguard your personal data.
– Data Processing Addendum (DPA): The terms under which we process personal data on your behalf.
– AI Processing Notice: How your data is processed in connection with our AI features.
– Terms and Conditions: The overall binding agreement governing your use of Transcy’s services.
– Privacy Policy: How we collect, use, and safeguard your personal data.
– Data Processing Addendum (DPA): The terms under which we process personal data on your behalf.
– AI Processing Notice: How your data is processed in connection with our AI features.
Don’t find the answer? We can help, contact us at support@transcy.io
Ready to go global?
Join 250,000+ merchants expanding worldwide. Free plan available.