Sub-processor List
Last updated: September 14, 2026
All End User Data is processed within the European Union. This page lists the third-party service providers ("sub-processors") that Ustyle SRL uses to deliver the Ustyle service. It is referenced by our Terms of Service, our Privacy Policy, and our Data Processing Addendum (DPA), and it is the authoritative version of the list: in case of difference with the annex of the DPA, this page prevails.
We distinguish between providers that process End User Data (personal data of shoppers on merchant stores, which we process on the merchant's behalf) and providers that process only merchant catalog data or merchant account data. Under Section 5 of the DPA, merchants are notified by email at least 30 days before a new provider that processes End User Data starts working for us, and may object on data protection grounds.
Providers that process End User Data
Microsoft Azure
Entity: Microsoft Ireland Operations Ltd., One Microsoft Place, Dublin 18, Ireland
Purpose: hosting of the Ustyle web application, storage of generated assets and synchronized catalog data
Data: End User Data (pseudonymized identifiers, behavioral events, order attribution data), merchant account data, catalog data
Location: North Europe region (Ireland)
Safeguard: EU processing; Microsoft Products and Services Data Protection Addendum.
Amazon Web Services
Entity: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg
Purpose: DynamoDB database operations
Data: End User Data (pseudonymized identifiers, behavioral events, order attribution data), catalog mappings
Location: EU (Frankfurt, Germany)
Safeguard: EU processing; AWS GDPR Data Processing Addendum.
Cloudflare
Entity: Cloudflare, with services for the EEA provided through its European entity Cloudflare Portugal, Unipessoal Lda., Largo Rafael Bordalo Pinheiro 29, 1200-369 Lisboa, Portugal
Purpose: content delivery network, DNS, and DDoS protection for the widget and the dashboard
Data: End User Data in transit only (IP address and request metadata); no storage of End User Data
Location: European Union. Traffic from the EEA is served by Cloudflare’s European edge nodes, and no End User Data is stored at the edge. Contractual EU-only regionalisation (Cloudflare Regional Services, so that TLS termination happens only inside the EU, together with the Customer Metadata Boundary for logs and metadata) is available on request for merchants who require it.
Safeguard: Cloudflare Data Processing Addendum incorporating the Standard Contractual Clauses; Cloudflare is certified under the EU-US Data Privacy Framework.
Providers that process merchant catalog data only (no End User Data)
Google Cloud Platform (Vertex AI generative models)
Entity: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, with model inference operated on Google Cloud’s European and global infrastructure
Purpose: machine learning inference and image generation (product analysis, outfit combination, virtual try-on imagery). Calls are routed through Ustyle’s own AI gateway, hosted on Azure North Europe (Ireland).
Data: catalog data only (product images, titles, descriptions, metadata)
Location: European Union for catalogue analysis and outfit generation, which run in Google’s EU regions. Image generation currently runs on Google’s global model endpoint, which may process catalog data outside the EU; this is the only part of the service that does so, and it never receives End User Data.
Safeguard: Google Cloud Data Processing Addendum incorporating the Standard Contractual Clauses; Google is certified under the EU-US Data Privacy Framework for any processing outside the EU; customer data is not used to train Google models.
Other AI model providers
Ustyle may engage additional or alternative AI model providers for inference and image generation. Any such provider processes catalog data only, never End User Data, is engaged under terms that prohibit training on merchant data, and is added to this list before use, with a notice to merchants under Section 12.3 of the Terms of Service.
Providers that process merchant account or usage data only
PostHog
Entity: PostHog, on its European Cloud instance hosted in Frankfurt, Germany
Purpose: product usage analytics of the Ustyle merchant dashboard
Data: merchant staff dashboard usage events, technical logs
Location: EU (Frankfurt, Germany)
Safeguard: EU processing; PostHog Data Processing Agreement.
Shopify and WooCommerce (Automattic)
All Ustyle subscriptions are billed through these platforms' app stores. The platforms act as independent controllers for that billing under their own privacy policies. They are listed here for transparency and are not sub-processors of Ustyle; Ustyle does not use a separate payment provider.
Changes to this list
We review this list whenever we add, replace, or remove a provider and at least once a year. Merchants with an active subscription receive an email notice at least 30 days before a new provider that processes End User Data starts working for us. To receive notifications about changes to this list, write to [email protected] with the subject "Sub-processor updates".
Change log
- September 14, 2026: stated the Cloudflare location as the European Union and noted that contractual EU-only regionalisation is available on request; separated Google Vertex AI into catalogue analysis in EU regions and image generation on the global endpoint, in place of the earlier combined wording; recorded that AI calls are routed through Ustyle’s own gateway in Azure North Europe; named the European contracting entities for Cloudflare, Google and PostHog in place of their group headquarters.
- September 6, 2026: page created. Clarified that AI model providers receive catalog data only; added the "Other AI model providers" entry.
Contact
Questions about this list can be sent to [email protected], or by post to Ustyle SRL, c/o I3P, Incubatore del Politecnico di Torino, Corso Castelfidardo 30/A, 10129 Torino TO, Italy.