How to read this page
In short: a sub-processor is a company Vertia engages that may process store data so we can provide the service. Each one is bound by a data protection agreement.
The list has three parts:
- Sub-processors: process the data of stores' customers and creators on behalf of Vertia and the store. They are covered by the Data Processing Agreement.
- Suppliers for your account data: process only merchant account data, which Vertia controls. They are covered by the Privacy Policy.
- Integrations you choose: platforms you contract directly and connect to Vertia. They are not Vertia sub-processors.
What stays in Brazil. The database, files, application and store email sending are located in São Paulo, Brazil. Some suppliers process data in the United States. The table shows which ones and under what legal mechanism.
Sub-processors
In short: six companies process store data so that Vertia can work.
| Supplier | Purpose | Data processed | Location | Transfer mechanism | Policy |
|---|---|---|---|---|---|
| Supabase (Supabase Pte. Ltd.) | Database, file storage, authentication and sign-in emails (magic link and sign-up confirmation) | All service data | Brazil: São Paulo (AWS sa-east-1). The supplier's support staff may access it from other countries | Data stored in Brazil. Access from abroad: LGPD: ANPD standard contractual clauses being formalised; for EU data, EU Standard Contractual Clauses and UK Addendum in the supplier's DPA | Privacy · DPA |
| Vercel Inc. | Hosting of the website and app, running functions, receiving platform notifications | All data in transit; technical request logs | Functions in Brazil: São Paulo (gru1). Account and technical logs in the United States | LGPD: ANPD standard contractual clauses being formalised; for EU data, EU Standard Contractual Clauses and UK addendum in the supplier's DPA | Privacy · DPA |
| Trigger.dev (API Hero Ltd) | Background jobs: processing platform notifications, imports, segmentation, sending outbound webhooks and retention routines | Job identifiers; while a job runs, the store data it processes | United States (AWS us-east-1, according to the supplier's DPA) | LGPD: ANPD standard contractual clauses being formalised; for EU data, EU Standard Contractual Clauses in the supplier's DPA | Privacy · DPA |
| Amazon Web Services (Amazon SES) | Sending store emails and recording delivery and opens | Recipient email address, message content, delivery events (delivered, bounced, complaint, unsubscribe) and open events, including the IP address and email-client user agent of the person who opened | Brazil: São Paulo (sa-east-1) | Data stored in the chosen region. Access from abroad: LGPD: ANPD standard contractual clauses being formalised; for EU data, EU Standard Contractual Clauses in the AWS DPA | Privacy · Data protection |
| Resend | Product emails: invitations, merchant notices and account access | Recipient name and email, and the notice content. Privacy request notices never include the customer's name or contact details | United States (account data, logs and metadata) | LGPD: ANPD standard contractual clauses being formalised; for EU data, Data Privacy Framework and EU Standard Contractual Clauses in the supplier's DPA | Privacy · DPA |
| Sentry (Functional Software, Inc.) | Error logging for the app and background jobs | Stack traces and technical identifiers (store, request, job). No names, emails, IP addresses, cookies or content, by configuration | United States | LGPD: ANPD standard contractual clauses being formalised; for EU data, Data Privacy Framework, with EU Standard Contractual Clauses (Modules 2 and 3) and UK Addendum as fallback | Privacy · DPA |
Suppliers for your account data
In short: these suppliers only see data about the merchant and their team, never the store's customers.
| Supplier | Purpose | Data processed | Location | Transfer mechanism | Policy |
|---|---|---|---|---|---|
| "Continue with Google" sign-in for merchants, when you choose it | Your Google account name and email | Google servers in several countries | You use your own Google account, under your terms with Google | Privacy | |
| BrasilAPI | Filling in the store's address from a Brazilian postal code (CEP), Brazil only | The postal code you type and your browser's IP address, since your browser makes the lookup | Not stated by the service | Lookup made by your browser to a free public service | The service does not publish a privacy policy |
Billing. Shopify stores pay for Vertia through Shopify itself (Shopify Billing). Payment details stay with Shopify; Vertia never receives card numbers.
Integrations you choose
In short: you contract your store platform and Meta yourself. Vertia exchanges data with them on your instructions, but they are not our sub-processors.
| Platform | What Vertia does with it | Role | Policy |
|---|---|---|---|
| Shopify | Reads customers, orders, discounts and products; creates discounts (creator coupons); receives the store's privacy requests | You contract Shopify. It is responsible for the data it processes, under its own terms | Privacy |
| Nuvemshop | Reads customers, orders and products; creates discount codes; receives the store's privacy requests | You contract Nuvemshop. It is responsible for the data it processes, under its own terms | Privacy |
| Meta (WhatsApp Cloud API) | Sends WhatsApp messages through your WhatsApp Business account and receives statuses and replies. Vertia acts as a Tech Provider | The account and number are yours, and Meta bills conversations to you directly. On the Cloud API, Meta processes messages as your business's processor, under the terms you accept with Meta | WhatsApp Business Data Processing Terms |
Why Meta is listed here rather than as a sub-processor. The market is split. Some providers list Meta as a sub-processor; others treat it as an independent company the customer connects. We follow what Meta itself says: on the Cloud API, Meta is the processor of the business that owns the WhatsApp Business account, which is you, and the contract is between you and Meta. We list it here, with its role explained, so you know message data passes through it. According to Meta's documentation, messages are retained for up to 30 days in Meta's data centers.
How we announce changes
In short: before adding or replacing a sub-processor, we email notice 15 days in advance. You can object.
- Subscribe to notices. Email privacidade@usevertia.com with the subject line "Subscribe to sub-processor notices", from the address that should receive them. To unsubscribe, use the subject line "Unsubscribe from sub-processor notices".
- Notice period. We update this page and send the notice at least 15 days before a new sub-processor starts processing data.
- Objection. Within those 15 days, reply to the notice explaining your reasons. Section 8 of the Data Processing Agreement explains what happens next.
- Emergencies. If a change has to be immediate, to protect the data or keep the service running, we notify you as soon as possible, and your right to object still applies.
- Removals. When a supplier leaves the list, we update this page and the date at the top.