Legal
Spiffy’s Sub-Processors
Current sub-processors used by Spiffy to provide infrastructure, email, payment, fraud prevention, and support services.
Updated: July 18, 2026 | Data Processing Agreement
Spiffy uses sub-processors to assist in providing the Services (as described in the Terms of Service). The tables below distinguish between platform sub-processors, which may process personal data that you and your customers submit to the Service, and business-operations vendors, which handle the account and contact details of Spiffy customers (merchants) and are not used to process your customers' personal data.
All data stored at rest by Spiffy and its platform sub-processors resides in data centers located in the United States.
Platform Sub-Processors
These providers may process personal data belonging to you and your end customers.
| NAME | SUBJECT | PURPOSE | DATA CENTERS |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud Service Provider | Cloud infrastructure provider for Spiffy, where uploads are stored. The SpiffyJS library is delivered through the AWS content delivery network, whose edge servers cache static assets globally; stored data resides in US data centers. | US |
| DigitalOcean, Inc. | Cloud Service Provider | Cloud infrastructure provider for Spiffy, where non-application related assets are hosted. | US |
| Fly.io | Cloud Service Provider | Cloud infrastructure provider for Spiffy, where all applications are hosted. Almost all data stored, processed, and transmitted through Spiffy resides on Fly data centers. | US |
| MailGun, Inc. | Email Provider | Sending transactional emails to merchants and end customers. Mail servers are provided by Mailgun to deliver emails from the product. | US |
| MaxMind | Fraud Prevention | IP geolocation used as a fraud prevention tool and to adapt/localize checkouts based on the visitor's general region. | US |
| Google Cloud | Fraud Prevention | Google reCAPTCHA is used as a spam and fraud prevention tool. Google Maps is used for address detection and autocompletion. | US |
| Sentry | Error Monitoring | Error monitoring tool that helps find, triage, and prioritize application errors in real time. | US |
| Stripe | Payment Gateway | Card vault and payment gateway provider for Spiffy's account billing. Merchants can also integrate their own account for processing end customer transactions. | US |
| PostHog | Product Analytics | Product analytics used to understand and improve how the Service is used, including hosted checkout sessions; captures usage events, device/browser information, and IP addresses. | US |
| Tinybird | Analytics Data Storage | Real-time analytics data storage powering Spiffy's reporting and analytics features; stores order and checkout event data. | US |
| Anthropic | AI Provider | Large language model API powering in-app AI features such as analytics insights and generated text; processes the account data included in a given request, typically aggregated analytics and merchant-authored content. | US |
| OpenAI | AI Provider | Large language model API powering in-app AI features such as analytics insights and generated text; processes the account data included in a given request, typically aggregated analytics and merchant-authored content. | US |
Business-Operations Vendors
These providers handle the account and contact details of Spiffy merchants. They are not used to process your customers' personal data.
| NAME | SUBJECT | PURPOSE | DATA CENTERS |
|---|---|---|---|
| GoHighLevel | CRM/Marketing Platform | Sending transactional, service update, and product-related emails to merchants only. | US |
| N8N | Workflow Automation | Workflow automation for Spiffy's internal business processes; merchant account and contact details may pass through automated workflows. | US |
| Slack | Community Platform | Community platform for team communication and collaboration; Spiffy customers may be invited to join the Spiffy community. | US |
| Help Scout | Customer Support Platform | Support inbox and help desk for merchant support conversations; handles merchant contact details and the content of support requests. | US |
| Fireflies.ai | Meeting Transcription | Records and transcribes scheduled calls with Spiffy (such as sales, demo, and support calls) and internal meetings. | US |
| Google Workspace | Email & Productivity Suite | Hosts Spiffy's business email (including the support and privacy mailboxes) and internal documents. | US |
Changes to This List
When we add or replace a platform sub-processor, we will email the owner of each active Spiffy account at least 10 business days before the new sub-processor begins processing personal data, and we will update this page. No separate subscription is needed — notices go to the account owner email on file.
We may begin using the new sub-processor once the notice period has ended. If you object to a change, email privacy@spiffy.co within 30 days of the notice and we will discuss it with you in good faith. Because sub-processors are often integral to how the Service operates, where we cannot reasonably accommodate an objection your remedy is to cancel your subscription, as described in the Data Processing Agreement.