This document is a working draft prepared for review by qualified Israeli and US counsel. It has not been approved and must not be treated as final. Items marked "For counsel" are open decisions.
Subprocessors
The service providers that process personal data for StockLine, verified against how the product actually works.
- Effective:
- (proposed)
- Last updated:
- Version:
- 2026-10-18-draft.1
1. About this list
StockLine uses the providers below to run the Service. This list was checked against the application code. Only providers the product actually calls are listed. Where a location says "verify", it has not yet been confirmed in the provider's console.
Data Processing Agreements and transfer clauses with these providers are not represented as signed in this draft. Sellers who need a DPA for the order data they receive can request our draft.
For counsel: collect and file each provider's DPA and transfer mechanism (SCCs / adequacy), confirm regions, and decide how customers are notified of subprocessor changes. A draft DPA for sellers is in docs/legal/DPA-draft.md.
2. Providers
| Provider | Service | Data processed | Location | Documentation |
|---|---|---|---|---|
| Supabase | Database, authentication (sign-in), file storage for catalog images | Account email and password hash, seller profile, catalogs, products, images, orders and buyer order details, buyer-account profiles, consent and request records, view statistics | Project region believed to be Asia-Pacific (Tokyo) — verify in the Supabase dashboard | supabase.com/privacy |
| Vercel | Application hosting and delivery; page-speed measurement (Speed Insights) only if you allow Analytics | IP address and request metadata in server logs; page paths and performance metrics (with consent) | Serverless functions believed to run in the US (iad1) — verify | vercel.com/legal/privacy-policy |
| Resend | Email delivery of new-order notifications to sellers | Seller notification email address; order contents including the buyer's name, phone, optional email and note | Believed United States — verify | resend.com/legal/privacy-policy |
| StripeNot active until configured | Subscription checkout, billing portal and payment processing for paid plans | Seller email, internal account ID, billing details entered at Stripe (card data is handled by Stripe, not StockLine). Buyers' order payments are not processed by StockLine or Stripe. | Global (US/EU) — verify; not yet configured for production at the time of this draft | stripe.com/privacy |
| Anthropic | Optional AI-written product descriptions (a seller must click to use it) | Only the product name, category, price/currency and notes or keywords the seller typed into that feature. No buyer data, images or account data are sent. | Believed United States — verify | www.anthropic.com/legal/privacy |
Currently not in use: PDF/spreadsheet catalog import is currently disabled in the product. If it is re-enabled, uploaded files would be processed by a document-extraction service hosted on Fly.io that uses Google Gemini; this page will be updated before that happens.