Subprocessors
A subprocessor is a third party that processes customer data on Selltics' behalf. This register lists every one, what it receives and where it processes it. One party receives no customer data at all and is listed because it holds the credentials that reach it.
Register
Grouped by what each party does. Always in the path means no customer can avoid it; only if used means only a customer who uses that feature reaches it.
The Data Processing Addendum published on the Selltics website is the authoritative contractual text, and this page does not restate its terms. It carries statements the September 2026 review disproved and whose withdrawal has not merged yet; where its account of a subprocessor and this register disagree, this register is the later one.
Read the Data Processing Addendum
Infrastructure
| Subprocessor | Purpose | Data it can see | Where it processes |
|---|---|---|---|
| CloudflareAlways in the path | The public entry point for everything Selltics serves: DNS, TLS termination, content delivery, the outbound tunnels that connect the platform to the internet, and the bot challenge on the sign-up, sign-in and account recovery forms. Cloudflare Workers runs the public status, trust and support pages, separately from the product platform, together with the storage those pages keep. Cloudflare Email Service delivers the account and security email Selltics sends, from a Selltics no-reply address, and Cloudflare's email routing forwards mail sent to Selltics' support address into the support mailbox. Cloudflare's identity-aware proxy also sits in front of internal interfaces, a use Selltics cannot evidence from its own records. | All traffic between a customer's browser and the platform, in readable form at the edge: account and session data, advertising figures rendered in the product, request metadata and visitor IP addresses. Challenge verification additionally sends the visitor's IP address to Cloudflare. For each account and security email, Email Service receives the recipient address, the subject and the body, which can include a single-use verification or password-reset link. Mail sent to the support address passes through Cloudflare on its way to the support mailbox. | Cloudflare's global edge network. Selltics does not pin a region. |
| Amazon Web ServicesAlways in the path | Carries Amazon's near-real-time advertising record stream into the platform and keeps a raw copy of it. Message queues receive the live stream and a delivery stream writes compressed batches to object storage; the queues and roles are created automatically when a seller connects an advertising account. Selltics' own collector also writes the performance records it receives into the same archive. A seller cannot connect an account without this path being used. Its parameter store also holds the secrets of the services, data stores and operational tools of the environment that holds customer data, encrypted under a key the provider manages, and the provider's audit log records every read of them. | Raw advertising stream records for connected accounts, meaning campaign, ad and performance events. While an advertiser account has at least one profile activated in Selltics, the performance records of every profile of that account are archived, including the profiles the customer did not activate. No customer's account credentials, no sign-in data and no payment data. The parameter store holds Selltics' own deployment secrets: database passwords, service and third-party credentials and the application's encryption keys, which are credentials that reach customer data rather than customer records. The archive is a continuous raw copy of the stream, not a backup taken occasionally. It is grouped per advertiser and marketplace and kept indefinitely, with no expiry on its raw records; apart from the seven-day deletion below, only records that fail delivery and records that carry no advertiser or marketplace expire, after twenty-one days. The performance records the collector writes are grouped per advertiser account and profile. Those of activated profiles are kept indefinitely as well; those of profiles the customer never activated are deleted seven days after the account's last activated profile is deleted, unless a profile of the account is activated again before those seven days end. A seller's part of the archive is deleted on that seller's written request. Records archived before the per-advertiser grouping existed are not grouped per seller and are being deleted in full. | A fixed provider region derived from the seller's advertising region rather than chosen by the customer: Ireland for the European advertising region and two United States regions for the North American and Far Eastern ones, so a Far Eastern seller's stream records are carried in the United States. The raw archive is a single bucket in Ireland for all regions. The parameter store holding deployment secrets is in Germany. |
| GitLabAlways in the path | Hosts the source code, stores and orchestrates the build and deployment pipelines, stores container images and private packages, and holds the credential variables the build pipelines use. It still holds the copies of the deployment secrets that the parameter store was filled from, until their removal. The pipeline jobs themselves execute on build machines Selltics runs, not on the vendor's shared build fleet. | No customer record and no advertising data. It does hold credential variables, the build pipelines' own and, until their removal, those copies of the deployment secrets, which is why it is listed here even though it processes no customer data. | GitLab's own service; the region is not selected by Selltics. |
Data source
| Subprocessor | Purpose | Data it can see | Where it processes |
|---|---|---|---|
| Amazon (Advertising API and Login with Amazon)Always in the path | The source of the advertising data the product exists to analyse, and the party a seller authorises when they connect an advertising account. One authorisation scope is requested and no other, and the grant can be withdrawn at Amazon. | Outbound: the seller's authorisation and the queries Selltics makes on their behalf. Inbound: that seller's advertising accounts, campaigns, ad groups, ads, targets, portfolios, budgets, advertised-product catalogue detail and performance records, plus a near-real-time record stream. | Amazon's regional advertising endpoints for Europe, North America and the Far East, selected by the advertising account the seller connects. |
Payments
| Subprocessor | Purpose | Data it can see | Where it processes |
|---|---|---|---|
| Payment provider (merchant of record)Always in the path | Takes payment as merchant of record and hosts the checkout, whose script loads in the customer's browser at payment time. Selltics stores the provider's references, the amounts and the status, and never receives card numbers or bank details. | What the customer enters at the provider's hosted checkout, which Selltics does not see. Inbound: the provider's confirmation message for each transaction, stored verbatim for up to ninety days, so whatever billing contact details the provider includes in it are held for that period. | Set by the vendor and not recorded by Selltics. |
Model provider
| Subprocessor | Purpose | Data it can see | Where it processes |
|---|---|---|---|
| DeepSeekOnly if used | The large language model behind the AI assistant, and the only model provider its code supports. It receives the seller's question together with the advertising data the assistant retrieved to answer it, and returns the answer text. Customers who do not use the AI assistant send nothing to any model provider. | The seller's own message, and advertising records for that seller's connected accounts. Performance figures are summed by day before they are sent, but catalogue and campaign detail is sent row by row: product identifiers, stock-keeping units, product titles, brands, categories and image links, campaign and ad-group names, budgets, bid strategies, targeting terms and the seller's own advertising account names. Each result set is capped in size and each run is capped in retrieval rounds, but there is no redaction step on this path. No sign-in credentials, no payment data and no Selltics account name or email address of the person asking. | Not recorded. No account region, data-residency option or retention setting is configured anywhere in the platform. DeepSeek is a China-based company, so a reviewer should assume processing outside Europe and the United States unless Selltics can show otherwise, which it currently cannot. |
Messaging
| Subprocessor | Purpose | Data it can see | Where it processes |
|---|---|---|---|
| TelegramOnly if used | The interface through which customers use the AI assistant today, and the channel for connection alerts the platform pushes to a linked chat. Linking a chat is a deliberate action a customer takes in the product and can undo there, and the dashboard works fully without it. Telegram is not the only way into the assistant: an authenticated route into the same assistant run exists without it, so declining Telegram is not the same as declining the assistant or the model provider behind it. | The whole conversation: the seller's questions and the assistant's answers, which contain that seller's advertising figures and catalogue detail, plus chart images built from the same data, plus any alert the platform sends to the linked chat. Charts are rendered inside Selltics' own systems and uploaded as images, so no third-party charting or image service is involved. | Telegram's own infrastructure. Not selectable by Selltics and not recorded. |
| Google (mailbox)Only if used | Carries and holds the correspondence a customer starts by writing to Selltics. The public support page delivers each submission as mail to Selltics' own mailbox at Google, and the same mailbox receives anything sent to the published address directly, including vulnerability reports and deletion requests, and anything sent to Selltics' support address, which Cloudflare forwards there. The operator reads and answers there by hand, so both halves of the exchange rest with Google. Nothing about the product requires it: a customer who never writes to Selltics sends it nothing. | What the sender chose to put in the message: the address they typed on the form, which is never verified as theirs, the topic they picked, the time it was submitted and up to five thousand characters of their own text, plus every reply the operator writes back. No advertising data, no sign-in credentials and no payment data travel this way, and no message is sent to a customer automatically from this mailbox. The correspondence is kept in the mailbox with no retention rule and no deletion schedule, so it stays until the operator removes it. | Google's own infrastructure. Not selectable by Selltics and not recorded, and the mailbox is an ordinary hosted account with no data-residency option and no negotiated processing term behind it. |
Other
| Subprocessor | Purpose | Data it can see | Where it processes |
|---|---|---|---|
| Google (sign-in)Only if used | Optional social sign-in. A customer who chooses it authenticates at Google, and Selltics receives an identity assertion in return. Customers who sign in with a password never touch it. | Google sees that the person signed in to Selltics. From the Google profile Selltics uses only the Google account identifier, the email address, whether Google has verified that address, and the given and family name; a sign-in whose address Google does not report as verified is refused. No advertising data, billing data or product content is shared with Google by this route. | Google's own infrastructure; not selectable by Selltics. |
| Google (font hosting)Only if used | The public documentation site requests its typefaces from Google's font service. It is the only Selltics interface or site that makes a third-party font request; the marketing site, the status site and this site ship their own font files. | A visitor's IP address, user agent and the fact that they loaded a page on the documentation site. No account data and no advertising data. | Google's global content network. |
Model providers
The AI assistant is optional. A customer who does not use it sends nothing to any model provider.
DeepSeek is the only model provider the assistant's code supports, so it is the only one that receives customer data. Using any other provider would take a deployment of new code, not a configuration change.
A prompt carries the seller's own question and the advertising records the assistant retrieved to answer it. Performance figures are summed by day before they are sent, but catalogue and campaign detail is sent row by row. Each result set is capped in size and each run is capped in retrieval rounds, and there is no redaction step on this path. No sign-in credentials, no payment data and no Selltics account name or email address of the person asking are sent.
Selltics cannot today show a negotiated term with any model provider that forbids training on submitted data or guarantees deletion after processing, and no data-residency or zero-retention setting is sent with a request.
This register is the change record: it is regenerated from the code, so a party that starts or stops receiving data appears or disappears here.
Selltics operates no formal process for notifying customers in advance of a subprocessor change or for handling an objection to one, and cannot today produce a countersigned data-processing agreement with any of the parties listed. Each party is used under whatever standard public terms applied when the account was opened, and those terms have not been captured, dated or reviewed on a schedule.
Do you sign a DPA, and will you tell me before a subprocessor changes?