Sub-processors
Effective Date 26 August 2026 Last Updated 26 August 2026
Retail Stack uses a small number of third-party service providers to operate the Service. Where those providers process personal data on our behalf, they act as sub-processors under our Data Processing Addendum.
Each sub-processor is engaged under a written agreement that imposes data protection obligations no less protective than those we owe to you, and each is given access only to the data necessary to perform its function.
This page is updated from time to time. Where we add or replace a sub-processor in a way that materially affects the processing of your data, we will notify affected merchants in advance in accordance with the Data Processing Addendum.
Current sub-processors
| Category | Provider | Purpose | Processing location |
|---|---|---|---|
| Cloud hosting | Hetzner Online GmbH | Primary application hosting and database storage | Germany |
| Payment processing (Nigeria) | Paystack Payments Limited | Direct debit mandates and merchant fee collection | Nigeria |
| Payment processing (other markets) | Stripe, Inc. | Card and direct debit collection for non-Nigerian markets | United States |
| Identity and authentication | Google LLC, Apple Inc. | Sign-in, where a merchant chooses social sign-in | United States |
| Push notifications | Google LLC (Firebase Cloud Messaging) | Mobile push notification delivery | United States |
| Product analytics | PostHog, Inc. | Product analytics and session replay, with text masked by default | United States |
| Mobile build and delivery | Expo, Inc. | Mobile application build and over-the-air updates | United States |
| Transactional email | Resend, Inc. | Delivery of service and notification emails | United States |
Categories of processing
Where a document refers to a category of sub-processor rather than a named provider, the categories are those set out in the table above: cloud hosting, payment processing, identity and authentication, push notifications, product analytics, mobile build and delivery, and transactional email.
International transfers
Some sub-processors process data outside the country in which your business operates. Where that occurs, transfers are made under the safeguards described in the Data Processing Addendum, including standard contractual clauses where applicable.
Objecting to a sub-processor
If you have a reasonable objection to a new sub-processor on data protection grounds, contact us at support@retailstack.co within thirty days of the notice. We will work with you in good faith to address the objection.
Contact
Retail Stack
Email: support@retailstack.co
Web: retailstack.co