The services WeaveCycle uses to run the product.

This early subprocessor list supports WeaveCycle's EU-first GDPR posture. It is a legal-review draft dated May 4, 2026.

Service provider

Vercel

Purpose

Web application hosting, preview deployments, CDN, and route execution.

Data categories

Public site traffic, web app requests, deployment logs, and limited account or session metadata.

Region posture

Frankfurt preferred for route execution where applicable; CDN/static delivery may be globally distributed.

Transfer safeguard

Provider DPA and Standard Contractual Clauses where non-EEA processing occurs.

Service provider

Render

Purpose

FastAPI service and worker hosting.

Data categories

Authenticated API requests, operational logs, Shopify sync events, and workspace workflow processing.

Region posture

Frankfurt production target.

Transfer safeguard

EU regional deployment plus provider contractual safeguards.

Service provider

Supabase

Purpose

Postgres database, authentication, and session management.

Data categories

User profiles, organizations, memberships, workspace records, auth identifiers, and application data.

Region posture

EU production target for the Supabase project.

Transfer safeguard

EU region selection plus provider DPA and transfer safeguards where applicable.

Service provider

PostHog

Purpose

Public analytics after consent and signed-in product analytics.

Data categories

Pageview and product usage events, browser metadata, timestamps, and event properties.

Region posture

EU host target: https://eu.i.posthog.com.

Transfer safeguard

Consent for public analytics, EU host configuration, and provider contractual safeguards.

Service provider

Shopify

Purpose

Merchant store OAuth, product/order/customer-related data source, and webhook delivery.

Data categories

Store domain, OAuth scopes, product records, order records, customer-related order data, and webhook metadata.

Region posture

Region depends on Shopify merchant account, Shopify infrastructure, and merchant configuration.

Transfer safeguard

Merchant authorization through Shopify OAuth and Shopify platform contractual terms.

Change handling

Early list, explicit updates.

WeaveCycle will update this page when material subprocessors are added or when the production region posture changes. A formal contractual subprocessor notice period should be added during legal review.

Merchants with a DPA, procurement, or data-residency requirement should contact founder@weavecycle.ai before sending live production data.