Sub-processor List
Last updated: September 6, 2026
This page lists the third-party service providers ("sub-processors") that Ustyle SRL uses to deliver the Ustyle service. It is referenced by our Terms of Service, our Privacy Policy, and our Data Processing Addendum (DPA), and it is the authoritative version of the list: in case of difference with the annex of the DPA, this page prevails.
We distinguish between providers that process End User Data (personal data of shoppers on merchant stores, which we process on the merchant's behalf) and providers that process only merchant catalog data or merchant account data. Under Section 5 of the DPA, merchants are notified by email at least 30 days before a new provider that processes End User Data starts working for us, and may object on data protection grounds.
Providers that process End User Data
Microsoft Azure
Entity: Microsoft Ireland Operations Ltd., One Microsoft Place, Dublin 18, Ireland
Purpose: hosting of the Ustyle web application, storage of generated assets and synchronized catalog data
Data: End User Data (pseudonymized identifiers, behavioral events, order attribution data), merchant account data, catalog data
Location: North Europe region (Ireland)
Safeguard: EU processing; Microsoft Products and Services Data Protection Addendum.
Amazon Web Services
Entity: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg
Purpose: DynamoDB database operations
Data: End User Data (pseudonymized identifiers, behavioral events, order attribution data), catalog mappings
Location: EU (Frankfurt, Germany)
Safeguard: EU processing; AWS GDPR Data Processing Addendum.
Cloudflare
Entity: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA
Purpose: content delivery network, DNS, and DDoS protection for the widget and the dashboard
Data: End User Data in transit only (IP address and request metadata); no storage of End User Data
Location: global edge network, with EU-located edge nodes serving EU traffic
Safeguard: Cloudflare Data Processing Addendum incorporating the Standard Contractual Clauses; Cloudflare is certified under the EU-US Data Privacy Framework.
Providers that process merchant catalog data only (no End User Data)
Google Cloud Platform (Vertex AI generative models)
Entity: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Purpose: machine learning inference and image generation (product analysis, outfit combination, virtual try-on imagery)
Data: catalog data only (product images, titles, descriptions, metadata)
Location: EU and United States
Safeguard: Google Cloud Data Processing Addendum incorporating the Standard Contractual Clauses; Google LLC is certified under the EU-US Data Privacy Framework; customer data is not used to train Google models.
Other AI model providers
Ustyle may engage additional or alternative AI model providers for inference and image generation. Any such provider processes catalog data only, never End User Data, is engaged under terms that prohibit training on merchant data, and is added to this list before use, with a notice to merchants under Section 12.3 of the Terms of Service.
Providers that process merchant account or usage data only
PostHog
Entity: PostHog Inc., 2261 Market St #4008, San Francisco, CA 94114, USA (EU-hosted instance)
Purpose: product usage analytics of the Ustyle merchant dashboard
Data: merchant staff dashboard usage events, technical logs
Location: EU (Frankfurt, Germany)
Safeguard: EU processing; PostHog Data Processing Agreement.
Shopify and WooCommerce (Automattic)
All Ustyle subscriptions are billed through these platforms' app stores. The platforms act as independent controllers for that billing under their own privacy policies. They are listed here for transparency and are not sub-processors of Ustyle; Ustyle does not use a separate payment provider.
Changes to this list
We review this list whenever we add, replace, or remove a provider and at least once a year. Merchants with an active subscription receive an email notice at least 30 days before a new provider that processes End User Data starts working for us. To receive notifications about changes to this list, write to [email protected] with the subject "Sub-processor updates".
Change log
- September 6, 2026: page created. Clarified that AI model providers receive catalog data only; added the "Other AI model providers" entry.
Contact
Questions about this list can be sent to [email protected], or by post to Ustyle SRL, c/o I3P, Incubatore del Politecnico di Torino, Corso Castelfidardo 30/A, 10129 Torino TO, Italy.