Sub-processors

i.Always — the platform itself

These apply to every merchant, because they are what Graymat runs on. Named individually in the list we send on request; described here by what each one does and where it holds data, which is what determines your obligations.

• Managed database and file storage — holds your operational data. Sees everything in your database. Cloud infrastructure, Asia Pacific (Tokyo).
• Application hosting and compute — runs the application and its scheduled jobs. Sees data in transit while a page or job runs. United States and global edge.
• Identity and access management — sign-in and accounts for your team. Sees your staff’s names, emails and sign-in activity — not your customers. United States.
• Content delivery, DNS and encrypted backup storage — serves this website and holds independent encrypted backups. Sees encrypted backup files. Global.
• AI language processing — drafts and analyses text on request. Sees only the text a feature sends it. Your data is not used to train any model. United States.

ii.Only if you connect it — messaging and stores

• Meta (WhatsApp Business Cloud API) — sends and receives your customer messages. Sees phone numbers and full message content.
• Meta (Graph API / Ads) — reads your advertising performance.
• Shopify — mirrors your orders and writes back tags and edits. Sees your orders and customers, in both directions.
• Google Ads and TikTok Ads — read your advertising performance.
• An advertising data connector — a third party that relays advertising metrics from one of the platforms above. Metrics only, no customer data. Being retired.

iii.Only if you connect it — couriers

A courier necessarily sees the customer’s name, phone, address and the amount to collect — that is what a delivery is. You choose which you use.

• PostEx · Leopards Courier · TCS — Pakistan
• CityMail — United Arab Emirates
• Nuport — Bangladesh
• Deliveryman — Kenya
• Daraz — where you sell on the marketplace

iv.Only if you use that feature — everything else

• Additional AI providers — some drafting, image and analysis features use a provider other than the one above. Each sees only what that feature sends it.
• Web page capture — capturing competitor and store pages. Public web pages only, no customer data.
• Federal Board of Revenue (Pakistan) — fiscal receipts, if you use the retail point of sale. Invoice totals and tax, as the law requires.

v.Changes to this list

30 days’ email notice before we add or replace a sub-processor, and you may object on data-protection grounds within those 30 days — the mechanism is clause v of the Data Processing Agreement. To request the named list, or to be told when it changes, email [email protected].