Version: v2
Last updated: 2026-09-15
Effective date: 2026-09-15
Notice period for changes: 30 days (Cervito will email all active merchants before adding a new sub-processor, and record the addition as a dated changelog entry below). One addition did not meet this — Cloudflare, engaged 2026-08-11 and disclosed 2026-09-15; see the changelog and the objection window it opened.
Cervito (the "Service") engages the third parties listed below to deliver the
AI Shop Assistant product. Each is engaged under its own Data Processing
Addendum (DPA) or equivalent agreement, and each of those agreements
incorporates Standard Contractual Clauses (SCCs) for international transfers of
EU/UK personal data. Each transfer outside the EU/EEA currently rests on the
SCCs incorporated in that vendor's own DPA, named in its row. Cervito's own
separately-signed SCC paperwork is still being finalised with counsel — see
International data transfers below for exactly what is and is not executed.
2026-09-15 — a late notice. Cloudflare has been in front of app.cervito.io and crm.cervito.io since 11 August 2026. We added it without the 30 days' advance notice this page promises, and we are disclosing it now. If you want to object, you have until 15 October 2026 — the same right and the same remedies you would have had with advance notice. See the changelog.
Which document wins. This page is the canonical sub-processor register, published at app.cervito.io/docs/legal/sub-processors. Your contract is the DPA at cervito.io/legal/dpa, which you accepted at registration, and that DPA incorporates this page by reference — so the sub-processors named here are the sub-processors you have authorised. The tables at cervito.io/legal/dpa §4, cervito.io/security and app.cervito.io/docs/legal/dpa-addendum are copies of this page. Where a copy disagrees with this page, this page is correct.
If you have questions or want a copy of any specific DPA, email
[email protected] (or [email protected]).
These vendors process personal data that originates from your storefront
visitors (chat messages they type, email addresses they submit, product
interactions, etc.) on Cervito's behalf as a Processor.
Your own platform is listed for transparency, not engaged by Cervito. Every row below except the store-platform row is a processor Cervito engaged and acts on Cervito's instructions. The store-platform row is listed so the data flow is visible; see the note under the table.
| # | Sub-processor | Role / Purpose | Data processed | Hosting region(s) | Vendor DPA / Security |
|---|---|---|---|---|---|
| 1 | Anthropic, PBC (USA) | LLM provider for chat responses (Claude API) | Visitor chat messages + recent assistant turns + your store catalog snippets + visitor's name and last-purchase titles if identified. Zero-retention on Anthropic's side per their commercial API terms. | USA. EU/UK routing via AWS Bedrock is roadmap only — see "Sub-processors that may be added later" below. | Anthropic DPA (incorporated into Anthropic's Commercial Terms of Service), incorporating SCC Module Two and Module Three and the UK International Data Transfer Addendum — URL + content verified 2026-09-15. ⚠ Anthropic is not listed on the EU-U.S. Data Privacy Framework registry as of 2026-09-15. · Trust Center |
| 2 | OpenAI, L.L.C. (USA) | Two purposes. (a) Vector embeddings for product semantic search (text-embedding-3-small). (b) Speech-to-text transcription of a shopper's recorded voice clip (whisper-1) for the widget's voice input, where your store has voice input enabled — it is on by default; you can switch it off in your dashboard settings. On browsers with native speech recognition (including Chrome) the audio is transcribed by the browser and never reaches Cervito or OpenAI; the shopper is told which path applies at the moment they press the microphone. | (a) Product titles, descriptions and tags from your catalog. (b) The audio of a shopper speaking, and the transcript OpenAI returns. The audio is transcribed and discarded — never written to disk or to our database, never logged, never attached to an event; the transcript is returned to the shopper's browser and then handled as ordinary chat text. We keep one billing record per call — provider, model, audio duration, byte count, latency, status — which contains no audio and no transcript. | USA | OpenAI DPA, which incorporates the EU SCCs (Commission Decision of 4 June 2021) and the UK Addendum issued under s.119A(1) DPA 2018 — verified 2026-09-15. ⚠ OpenAI is not listed on the EU-U.S. Data Privacy Framework registry as of 2026-09-15. · Trust Portal |
| 3 | Cloudflare, Inc. (San Francisco, USA) | Reverse proxy and edge for app.cervito.io and crm.cervito.io (both proxied since 2026-08-11: Cloudflare decrypts traffic at its edge and re-encrypts it on the way to our servers in the Netherlands), plus DNS, WAF and cookieless Web Analytics for the marketing site cervito.io (Cloudflare Pages). Because the widget's production backend has been https://app.cervito.io since 2026-06-22 and live merchant storefronts embed https://app.cervito.io/widget.min.js, shopper chat, streaming responses and voice uploads from those embeds pass through Cloudflare in transit. The raw origin cervito.up.railway.app is not proxied. | IP addresses, request headers, request and response content in transit, and traffic-routing metadata. Cloudflare does not receive a separate copy of the database. The marketing-site analytics is cookieless: no cookies, nothing stored on the visitor's device, no fingerprinting, no cross-site tracking. | European Union and United States. Traffic is handled by whichever Cloudflare data centre is nearest the visitor; for EU and UK shoppers that is normally an EU data centre. Content is processed only in transit; Cloudflare states it is not retained. Traffic metadata (IP address, timing, routing) is processed in Cloudflare data centres in the EU and the United States. | Cloudflare Customer DPA version 6.4, effective 2026-04-03, incorporating EU SCC Module Two and Module Three and the ICO International Data Transfer Addendum version B1.0 — fetched and verified 2026-09-15. Cloudflare's own sub-processors: cloudflare.com/gdpr/subprocessors. DPF registry (checked 2026-09-15): EU-U.S. DPF, Swiss-U.S. DPF and the UK Extension all Active. |
| 4 | Railway Corporation (USA-incorporated; EU hosting) | Application + database hosting (Cervito's server + its SQLite DB, and the separately-deployed CRM service + its Postgres) | All Cervito data stored on Railway's managed volumes (encrypted at rest by Railway). | European Union — region europe-west4 (Netherlands), one replica, read from the Railway project's service settings via the Railway CLI (railway status, region europe-west4, one replica) on 2026-09-15 and corroborated by the boot-time residency guard in src/server.js, which warns if the region is not europe-*. This covers the app service and its /data SQLite volume, the CRM service, and the CRM's Postgres. Cervito's commitment is to keep production hosting within the EU/EEA; the specific country may change within the EU/EEA. | Railway DPA · Security. DPF registry (checked 2026-09-15): EU-U.S. DPF, Swiss-U.S. DPF and the UK Extension all Active. |
| 5 | Resend, Inc. (USA) | Transactional email. Merchant-directed: signup verification, daily debrief, cost-budget alerts. Visitor-directed: the self-service privacy portal's verification link, the data export itself, and the erasure confirmation (src/routes/privacy.js, purposes privacy-verification-email, privacy-export-email, privacy-redact-email). | Recipient email address (merchant or storefront visitor), sender/subject, email body, and — where an export is delivered — the exported personal-data file. | USA. Resend states that stored data is held in the United States, and that the region selected when adding a domain controls where email is sent from, not where it is stored (resend.com/security, verified 2026-09-15). | Resend DPA — accepted by Cervito as part of Resend's terms of service · Security, which names Standard Contractual Clauses and the EU-U.S. Data Privacy Framework as the transfer mechanisms. DPF registry (checked 2026-09-15): EU-U.S. DPF and the UK Extension listed "Active - Re-certification under Review" for non-HR data; no Swiss listing. While a listing is "Re-certification under Review", Cervito relies on the Standard Contractual Clauses in that vendor's agreement, not on the Framework, as the transfer mechanism. |
| 6 | Shopify Inc. — *the merchant's own platform, not a Cervito-procured sub-processor* | E-commerce platform integration (Admin API + Storefront API) | Your store catalog, order data, and customer email/name/order history (only for shops that grant the read_customers scope). Cervito is your Processor for what it reads; the platform relationship is yours. | Per your own Shopify plan and region | Shopify DPA · Shopify Trust Center |
These vendors only handle data about you (the merchant) — your name, email,
business correspondence, dashboard activity. They do not see your visitors'
data.
| # | Sub-processor | Role / Purpose | Data processed | Hosting region(s) | Vendor DPA / Security |
|---|---|---|---|---|---|
| 7 | Google LLC (USA) | Four purposes. (a) OAuth sign-in (Sign in with Google) — only invoked if you choose this sign-in method. (b) Google Workspace mailboxes that receive merchant correspondence (for example [email protected] and [email protected]). (c) The appointment scheduler embedded on cervito.io/book. (d) Google Meet for the 30-minute demo call a prospect books. (c) and (d) concern prospects' own data, where Cervito is the controller; they are listed for transparency, not as processing on your behalf. | (a) Email address + Google profile name. (b) Whatever you write to us, and our replies. (c) and (d) The booking and meeting details a prospect chooses to submit, plus the audio, video and connection data Google processes to run the call. | Multi-region (United States / EU) | Google Cloud DPA · Trust Center. DPF registry (checked 2026-09-15): EU-U.S. DPF, Swiss-U.S. DPF and the UK Extension all listed "Active - Re-certification under Review". While a listing is "Re-certification under Review", Cervito relies on the Standard Contractual Clauses in that vendor's agreement, not on the Framework, as the transfer mechanism. |
These are listed in advance because they're on Cervito's near-term roadmap.
Merchants will be re-notified 30 days before any of these become active
sub-processors.
| Sub-processor | Planned role | Status |
|---|---|---|
| AWS Bedrock (EU regions) | Alternate Claude API routing for EU data residency. | Roadmap (no active processing) |
Cervito's production application and database are hosted in the European
Union (currently the Netherlands — see row 4). Some of our sub-processors are
located outside the EU/EEA (notably in the United States — see the rows above).
Where personal data is transferred to them, we rely on the European
Commission's Standard Contractual Clauses (and, for UK data, the UK
International Data Transfer Addendum), together with additional safeguards.
We are finalizing the formal transfer documentation with legal counsel and
will make the relevant clauses available to merchants on request.
Per-vendor mechanism. Each vendor row above names the vendor's own DPA and
the SCC modules that DPA incorporates. That is the mechanism the transfer
currently rests on. ⚠ Cervito has not executed bilateral, separately signed
SCCs with each vendor — this page previously said it had, and that was wrong;
see the changelog. Do not describe Cervito's SCCs as "signed" until counsel
confirms executed paperwork.
Data Privacy Framework status. Where a row records a DPF listing, that
status was read from the public registry at dataprivacyframework.gov on the
date shown. A DPF certification can lapse, so DPF status is re-checked at
each review of this list and the date in the row is updated then. Two
vendors — Anthropic and OpenAI — are not on the registry at all, which is why
their rows rely on SCCs alone.
Supplementary measures include encryption in transit (TLS 1.2+), encryption
at rest (AES-256-GCM for platform access tokens + database file-level),
access controls (Cervito staff only; no third-party access to the database),
and the Shopify-mandated GDPR webhooks (customers/redact, shop/redact,customers/data_request).
If Cervito adds a new sub-processor, you'll receive at least 30 days notice
via the email associated with your Cervito account, and the addition is
recorded as a dated entry in the changelog below. You may object by emailing
[email protected] — or [email protected], which is monitored daily —
within that 30 days. If we cannot accommodate your objection (for example by
routing your shop's data away from the new sub-processor), you may terminate
the affected portion of the Service for cause, and we will refund any prepaid
fees for the unused portion of the term.
| Date | Change |
|---|---|
| 2026-09-15 | v2 — corrections, and one late disclosure. (1) Cloudflare, Inc. added. Cloudflare has proxied app.cervito.io and crm.cervito.io since 2026-08-11, which is before this disclosure — it was engaged without the 30 days' advance notice this list promises. Disclosed 2026-09-15. Objection window: 30 days from the date of the notice email and not earlier than 2026-10-15; the send date will be recorded here. A merchant who objects within that window has the remedies in "How to object" above, exactly as if notice had been given in advance. (2) OpenAI voice transcription disclosed. The prior row said "NO visitor chat or PII is sent to OpenAI." That sentence was wrong: shopper voice clips go to whisper-1 for tier-2 voice input. It has been deleted and the row now names both purposes. (3) Hosting corrected from USA to EU. The Railway row read "USA (us-west, us-east)". That cell was wrong — production has run in europe-west4 (Netherlands). (4) Resend moved from §2 to §1. It delivers the visitor self-service export and erasure emails, so it processes visitor personal data, not merchant data only. (5) "EU edge delivery" removed from the Resend row — resend.com/security states stored data is held in the United States. (6) Stripe removed from §3; billing has been bank-transfer only since 2026-06-29. (7) The claim that SCCs are "signed between Cervito and each non-EU sub-processor" was replaced with the per-vendor mechanism plus the interim transfer statement. (8) DPF registry statuses recorded per row, and [email protected] added as a second objection address. |
| 2026-05-17 | Initial publication. Anthropic, OpenAI, Shopify, Railway, Resend, Google listed. Stripe + AWS Bedrock listed as not-currently-engaged. |