Scope
This list identifies third parties engaged by the operator to process merchant personal data for the Service. The operator's legal identity must be completed before external production use. Last reviewed August 4, 2026.
Railway Corporation
- Service: application hosting, runtime, PostgreSQL database, backups, networking and related infrastructure.
- Address: 548 Market St PMB 68956, San Francisco, California 94104, United States.
- Processing locations: European deployment region, with Railway's primary processing operations in the United States and possible access or processing by its authorized subprocessors in other countries.
- Transfer safeguards: Railway DPA, EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
Merchant-selected services
Shopify is the merchant's commerce platform and data source. Attio is the merchant-selected destination. The merchant contracts with and configures both services; they are therefore described in the privacy policy and data flow but are not listed here as subprocessors appointed by the operator for those transfers.
Changes and objections
The operator will keep this list current and provide reasonable advance notice before appointing a new or replacement subprocessor. Merchants may object on documented data-protection grounds under the DPA. A reliable notification and subscription mechanism must be implemented before external production use.
Contact
Questions or objections can be sent to the support address below. Do not include customer records, access tokens or other unnecessary personal data.