A subprocessor is a third party that processes personal data on our behalf in order to provide the nohold service. This page lists every subprocessor nohold uses, what they do, and what data they have access to. We keep this list current and notify customers before adding new subprocessors that process customer data.
Marketing site & waitlist
These subprocessors support nohold.app and the waitlist signup. Anyone who visits the site or joins the waitlist is in scope.
| Subprocessor | Purpose | Data they see |
|---|---|---|
| CloudflareCloudflare, Inc. · Global edge | Hosts the nohold.app marketing site, runs the waitlist Pages Function, and stores the waitlist database (D1). Provides DNS, TLS, and DDoS protection. | Waitlist email addresses. IP address, user agent, and request metadata for security and abuse prevention. |
Product
These subprocessors support the nohold product itself. Only merchants who install and use nohold are in scope. The product is currently in pre-launch; this list reflects the production architecture as of the effective date below.
| Subprocessor | Purpose | Data they see |
|---|---|---|
| BrightpearlBrightpearl Ltd. · Merchant-controlled | When a Shopify order is split, we forward the customer and line-item data to the merchant's own Brightpearl account so the resulting sales orders carry the right customer and delivery details. Brightpearl is the merchant's chosen ERP, not a vendor we engage; we send data the merchant chose to integrate. | Customer name, email, phone, shipping and billing addresses, order line items, quantities, totals. |
| ResendResend, Inc. · EU (Ireland, eu-west-1) | Delivers per-shipment customer notification emails when a merchant enables the customer-communication feature. Receives only the data needed to render each transactional email. | Customer email address, first name (if present on the order), Shopify order number, item names and quantities on each shipment half. |
| Google CloudAlphabet Inc. · europe-west1 | Runs the nohold application: Cloud Run, Cloud Tasks, Cloud Scheduler, Secret Manager, KMS, Artifact Registry, and Cloud Storage (Terraform state). | All product traffic. Encrypted Shopify and Brightpearl tokens at rest. Application request logs. |
| NeonNeon, Inc. · EU | Managed Postgres for the nohold-dev and nohold-prod projects. Stores all operational state for the splitting and dispatch engine. | Merchant accounts and configurations, split orders, dispatch queue, fulfillment holds, audit logs, encrypted Shopify and Brightpearl OAuth tokens. |
| CloudflareCloudflare, Inc. · Global edge | DNS and TLS for nohold-controlled domains. | DNS lookups; in-transit metadata if traffic is proxied. |
Changes & notifications
We will update this page before adding a new subprocessor that processes customer data. Where applicable, we will notify customers under contract by email at least 14 days in advance, and customers may object as set out in their data processing addendum. Removed subprocessors will be replaced by an updated table.
Contact
Questions about our subprocessors: privacy@nohold.app.